HomeLift Privacy Policy

RUVIENT Technologies Private Limited

Effective Date: 20 May 2026 Version: 2.0 Last Updated: 20 May 2026 Document ID: RUVIENT-LEGAL-PP-2026-002

VERSION HISTORY

TABLE OF CONTENTS

1. Definitions and Interpretation
2. Scope and Applicability
3. Data We Collect
4. How We Collect Data
5. Purpose and Legal Basis for Processing
6. Third-Party Data Processors
7. Cross-Border Data Transfers
8. Data Retention Schedule
9. Your Rights Under DPDP Act 2023
10. Children's Data
11. Cookies and Tracking Technologies
12. Security Measures
13. Data Breach Notification
14. Grievance Officer
15. Changes to This Policy
16. Governing Law and Jurisdiction
17. Contact Information

1.0 DEFINITIONS AND INTERPRETATION

1.1 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

"Account" means the registered user account created by You on the HomeLift Platform to access and use the Services.

"Applicable Law" means the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and any other applicable legislation, regulation, or statutory instrument in force in India.

"Children" or "Child" means any individual below the age of eighteen (18) years, as defined under Section 9 of the DPDP Act, 2023.

"Consent" means free, specific, informed, unconditional, and unambiguous indication of the Data Principal's wishes by which they, by a clear affirmative action, signify agreement to the processing of their Personal Data, as defined under Section 6 of the DPDP Act, 2023.

"Consent Manager" means a person registered with the Data Protection Board who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw their consent, as defined under Section 6(7) of the DPDP Act, 2023.

"Data Breach" means any unauthorized processing of Personal Data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to Personal Data that compromises the confidentiality, integrity, or availability of Personal Data.

"Data Fiduciary" means RUVIENT Technologies Private Limited, which alone or in conjunction with other persons determines the purpose and means of processing of Personal Data, as defined under Section 2(i) of the DPDP Act, 2023.

"Data Principal" means the individual to whom the Personal Data relates, as defined under Section 2(j) of the DPDP Act, 2023. In the context of this Policy, "You," "Your," or "User" refers to the Data Principal.

"Data Processor" means any person who processes Personal Data on behalf of a Data Fiduciary, as defined under Section 2(k) of the DPDP Act, 2023.

"Data Protection Board" means the Data Protection Board of India established under Section 18 of the DPDP Act, 2023.

"Device Information" means information about the hardware and software of the device used to access the Platform, including but not limited to device model, operating system version, unique device identifiers, mobile network information, and IP address.

"GPS Location" means the precise geographic coordinates (latitude and longitude) of a device as determined by the Global Positioning System or equivalent satellite navigation systems.

"Grievance Officer" means the officer appointed under Section 13(3) of the DPDP Act, 2023, and Rule 5(9) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

"HomeLift" or "Platform" means the mobile application, web application, APIs, and all associated services provided by RUVIENT Technologies Private Limited under the brand name "HomeLift."

"Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under Section 2(t) of the DPDP Act, 2023.

"Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, restriction, erasure, or destruction, as defined under Section 2(x) of the DPDP Act, 2023.

"Sensitive Personal Data" means Personal Data that reveals or relates to health data (including medication schedules), biometric data, financial data, data relating to children, or any other category as may be notified by the Central Government.

"Services" means all features, functionalities, and services offered through the HomeLift Platform, including but not limited to household management, staff attendance tracking, medication scheduling, expense management, and AI-powered assistance.

"Third-Party Processor" means any external entity engaged by RUVIENT Technologies to process Personal Data on its behalf for specified purposes.

"We," "Us," "Our," or "Company" means RUVIENT Technologies Private Limited, a company incorporated under the Companies Act, 2013, having its registered office in India (CIN: [To be inserted]).

"You," "Your," or "User" means any individual who accesses, uses, or registers on the HomeLift Platform.

1.2 Interpretation

(a) References to any statute or statutory provision include any subordinate legislation made under it and any modification, amendment, re-enactment, or replacement thereof.

(b) Words in the singular include the plural and vice versa.

(c) Headings are for convenience only and shall not affect the interpretation of this Policy.

(d) References to Sections are references to sections of this Privacy Policy unless otherwise stated.

(e) In the event of any conflict between the English version and any translated version of this Policy, the English version shall prevail.

2.0 SCOPE AND APPLICABILITY

2.1 Scope

This Privacy Policy applies to:

(a) All Personal Data collected, processed, stored, or transferred by RUVIENT Technologies Private Limited through the HomeLift Platform;

(b) All users of the HomeLift mobile application (Android and iOS);

(c) All users of the HomeLift web application;

(d) All interactions with HomeLift's AI-powered features, including voice-based interfaces;

(e) All household staff whose attendance and location data is processed through the Platform;

(f) All children whose information is stored on the Platform by their parents or legal guardians.

2.2 Territorial Applicability

This Policy applies to the processing of Personal Data:

(a) Within the territory of India, regardless of the nationality or residence of the Data Principal;

(b) Outside India, if such processing is in connection with any activity related to offering goods or services to Data Principals within India, in accordance with Section 3 of the DPDP Act, 2023.

2.3 Relationship with Other Agreements

This Privacy Policy is incorporated by reference into the HomeLift Terms of Service (Document ID: RUVIENT-LEGAL-TOS-2026-002). In the event of any conflict between this Policy and the Terms of Service regarding data protection matters, this Policy shall prevail.

3.0 DATA WE COLLECT

3.1 Categories of Personal Data

The following table provides an exhaustive list of Personal Data categories collected through the HomeLift Platform:

3.2 Special Categories of Data

The following data categories are treated with enhanced protection measures as per Section 9 of the DPDP Act, 2023 and the SPDI Rules:

(a) Health Data (medication schedules) — encrypted at rest with AES-256, access restricted to authenticated user only;

(b) Children's Data (school information) — collected only with verifiable parental consent, subject to additional safeguards per Section 3.2(c);

(c) Precise Location Data — collected only when app is in active use (foreground) unless explicit background permission is granted;

(d) Voice Recordings — transmitted over TLS to Our speech-to-text processor (Cloudflare Workers AI / Whisper), converted to text, and NOT stored as audio by Us or, to Our knowledge, retained by the processor beyond the transcription request. The resulting transcript may be sent to OpenAI for intent parsing (only if that feature is enabled); You may type instead of using voice to avoid this processing.

3.3 Data We Do NOT Collect

For the avoidance of doubt, HomeLift does NOT collect:

(a) Aadhaar numbers or other government-issued identification numbers; (b) Bank account numbers, credit/debit card numbers, or UPI IDs; (c) Caste, religion, political opinion, or sexual orientation; (d) Genetic or biometric data (fingerprints, facial recognition templates); (e) Criminal conviction or offense data; (f) Social media credentials or contacts from your phone's address book (beyond what you explicitly provide).

4.0 HOW WE COLLECT DATA

4.1 Data Provided Directly by You

The following data is collected when You voluntarily provide it:

4.2 Data Collected Automatically

The following data is collected automatically when You use the Platform:

4.3 Data Received from Third Parties

4.4 Consent Mechanism

(a) Initial Consent: At the time of account registration, You will be presented with a clear, plain-language notice describing the data we collect and the purposes for which it is processed. Your consent is obtained through an affirmative opt-in action (checking a consent box or tapping "I Agree").

(b) Granular Consent: For sensitive data categories (location, voice, health data, children's data), separate and specific consent is obtained at the point of collection through runtime permission dialogs and in-app consent screens.

(c) Withdrawal of Consent: You may withdraw consent at any time through the Privacy Settings section of the app (see Section 9.5). Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

(d) Consent Records: We maintain auditable records of all consent given, modified, or withdrawn, including timestamp, consent version, and method of consent, in compliance with Section 6 of the DPDP Act, 2023.

5.0 PURPOSE AND LEGAL BASIS FOR PROCESSING

5.1 Purposes of Processing

We process Your Personal Data for the following specified purposes:

5.2 Limitation of Purpose

(a) We shall not process Your Personal Data for any purpose other than those specified in Section 5.1 above without obtaining fresh consent.

(b) We shall not use Your Personal Data for automated decision-making that produces legal effects or similarly significant effects on You without explicit consent and human oversight.

(c) We do NOT sell, rent, or trade Your Personal Data to any third party for their marketing purposes.

(d) We do NOT use Your Personal Data for profiling for the purposes of targeted advertising by third parties.

5.3 AI and Machine Learning

(a) Voice You record in the Remember Box is converted to text by Cloudflare Workers AI (Whisper); the audio is processed in transit and is not stored. The resulting text (and text You type) may be sent to OpenAI's API (see Section 6.0) solely to structure it into suggested items (e.g. a grocery item, task, or reminder), which are saved only if You confirm them. This is an optional feature; You may type instead of speaking.

(b) We do NOT use Your Personal Data to train general-purpose AI models. Your data is used solely to provide You with personalized responses within the HomeLift Platform.

(c) You may opt out of AI features at any time through Settings > Privacy > AI Features without affecting other Platform functionality.

6.0 THIRD-PARTY DATA PROCESSORS

6.1 List of Sub-Processors

We engage the following third-party Data Processors to process Your Personal Data on Our behalf:

⚠️ Verification required before publication. The DPA status and certification entries above are placeholders. Do not state that a DPA is "Executed" unless a signed agreement is on file. Confirm each processor's region, certifications, and retention terms, then replace the placeholders. Tracked in compliance-checklist.md (H1–H3).

6.2 Sub-Processor Obligations

Each Third-Party Processor is contractually bound to:

(a) Process Personal Data only on Our documented instructions;

(b) Ensure that persons authorized to process Personal Data have committed themselves to confidentiality;

(c) Implement appropriate technical and organizational security measures as specified in Section 12.0;

(d) Not engage another processor without Our prior specific written authorization;

(e) Assist Us in responding to Data Principal rights requests under Section 9.0;

(f) Delete or return all Personal Data upon termination of the processing agreement;

(g) Make available all information necessary to demonstrate compliance and allow for audits;

(h) Immediately notify Us of any Data Breach affecting Personal Data processed on Our behalf.

6.3 Sub-Processor Changes

(a) We maintain an up-to-date list of Sub-Processors at https://homelift.app/legal/sub-processors.

(b) We will notify You at least thirty (30) days prior to engaging any new Sub-Processor or replacing an existing one.

(c) If You object to a new Sub-Processor, You may terminate Your account within the thirty (30) day notice period, and We will facilitate data export as per Section 9.4.

6.4 Processor Liability

RUVIENT Technologies remains fully liable for the acts and omissions of its Sub-Processors with respect to the processing of Your Personal Data, in accordance with Section 8(4) of the DPDP Act, 2023.

7.0 CROSS-BORDER DATA TRANSFERS

7.1 Transfer Destinations

Your Personal Data may be transferred to and processed in the following jurisdictions:

7.2 Legal Basis for Transfers

(a) Cross-border transfers are conducted in compliance with Section 16 of the DPDP Act, 2023, which permits transfer of Personal Data to jurisdictions not restricted by the Central Government.

(b) As of the effective date of this Policy, the Central Government has not notified any restricted jurisdictions under Section 16(1). Should any jurisdiction listed in Section 7.1 be subsequently restricted, We will:

• (i) Cease transfers to that jurisdiction within thirty (30) days;
• (ii) Migrate data to a permitted jurisdiction;
• (iii) Notify affected Data Principals within fifteen (15) days.

7.3 Safeguards for International Transfers

In addition to legal compliance, We implement the following safeguards:

(a) Encryption in Transit: All data transferred internationally is encrypted using TLS 1.3 (minimum TLS 1.2);

(b) Encryption at Rest: Data stored in foreign jurisdictions is encrypted using AES-256 with keys managed by RUVIENT Technologies;

(c) Data Minimization: Only the minimum necessary data is transferred to each processor (see Section 6.1, "Data Processed" column);

(d) Contractual Protections: Standard Contractual Clauses (SCCs) equivalent to EU SCCs are incorporated into all processor agreements;

(e) Access Controls: Foreign processors access data only through authenticated, audited API endpoints with role-based access controls;

(f) Regular Audits: We conduct annual assessments of each processor's data protection practices and security posture.

7.4 Data Localization

(a) Where technically feasible, We prioritize processing within India or the Asia-Pacific region.

(b) Health Data (medication schedules) is stored exclusively in the Singapore region (Supabase, AWS ap-southeast-1) and is not replicated to US-based systems.

(c) Voice audio is transmitted to Cloudflare Workers AI (Whisper) for transcription and is not stored as audio. The resulting text may be transmitted to OpenAI for intent parsing; configure OpenAI API terms for no model training and zero retention. [VERIFY both processors' retention settings.]

8.0 DATA RETENTION SCHEDULE

8.1 Retention Principles

(a) We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, as specified in Section 3.1.

(b) Upon expiry of the retention period, data is either securely deleted or irreversibly anonymized within thirty (30) days.

(c) Retention periods commence from the date of last activity associated with the data, unless otherwise specified.

8.2 Retention Schedule by Data Category

8.3 Deletion Procedures

(a) Automated Deletion: Data subject to time-based retention is automatically purged by scheduled deletion jobs running daily at 02:00 UTC.

(b) Manual Deletion Requests: Upon receiving a valid erasure request (Section 9.3), deletion is completed within thirty (30) days.

(c) Secure Deletion Methods: Data is deleted using cryptographic erasure (destroying encryption keys) for encrypted data, and secure overwrite (NIST SP 800-88 compliant) for unencrypted data.

(d) Backup Retention: Backups containing deleted data are purged within ninety (90) days of the deletion event. During this period, deleted data in backups is not actively processed or accessible.

8.4 Exceptions to Retention Limits

Data may be retained beyond the specified periods where:

(a) Required by Applicable Law, court order, or regulatory directive;

(b) Necessary for the establishment, exercise, or defense of legal claims;

(c) Subject to an active legal hold notice;

(d) Required for ongoing investigation of security incidents or fraud.

9.0 YOUR RIGHTS UNDER DPDP ACT 2023

9.1 Right to Access (Section 11(1)(a))

(a) You have the right to obtain confirmation as to whether Your Personal Data is being processed and, if so, access to such data.

(b) Upon request, We will provide You with:

• (i) The categories of Personal Data being processed;
• (ii) The purposes of processing;
• (iii) The categories of third parties with whom data has been shared;
• (iv) The retention period applicable to each data category.

(c) Access requests can be submitted through: Settings > Privacy > Download My Data, or by emailing privacy@ruvient.com.

(d) We will respond to access requests within seventy-two (72) hours and provide the data within thirty (30) days.

9.2 Right to Correction (Section 11(1)(b))

(a) You have the right to correct inaccurate or incomplete Personal Data.

(b) Corrections can be made directly through the app interface for most data categories.

(c) For data that cannot be self-corrected, submit a request to privacy@ruvient.com with supporting documentation.

(d) We will process correction requests within fifteen (15) days and notify all processors to whom the data was disclosed.

9.3 Right to Erasure (Section 11(1)(c))

(a) You have the right to request erasure of Your Personal Data, subject to the exceptions in Section 8.4.

(b) Erasure requests can be submitted through: Settings > Account > Delete Account, or by emailing privacy@ruvient.com.

(c) Upon receiving a valid erasure request:

• (i) We will verify Your identity through OTP or equivalent mechanism;
• (ii) We will provide a summary of data to be deleted and any data that must be retained (with reasons);
• (iii) Upon Your confirmation, deletion will be completed within thirty (30) days;
• (iv) We will instruct all Sub-Processors to delete Your data within the same timeframe.

(d) Erasure is irreversible. We recommend downloading Your data (Section 9.4) before requesting erasure.

9.4 Right to Data Portability

(a) You have the right to receive Your Personal Data in a structured, commonly used, and machine-readable format.

(b) Data export is available through: Settings > Privacy > Export My Data.

(c) Export formats available:

• (i) JSON (structured, machine-readable);
• (ii) CSV (tabular data);
• (iii) PDF (human-readable summary).

(d) Data export will be prepared within seventy-two (72) hours and available for download for seven (7) days.

9.5 Right to Withdraw Consent

(a) You may withdraw consent for any or all processing activities at any time.

(b) Granular consent withdrawal is available through: Settings > Privacy > Manage Permissions.

(c) You may withdraw consent for specific categories:

• (i) Location tracking;
• (ii) Voice recording;
• (iii) Analytics collection;
• (iv) WhatsApp notifications;
• (v) AI features.

(d) Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

(e) Certain core functionalities may be unavailable if consent for essential processing is withdrawn. We will clearly inform You of the consequences before processing the withdrawal.

9.6 Right to Grievance Redressal (Section 11(2))

(a) You have the right to lodge a complaint with Our Grievance Officer (see Section 14.0) regarding any processing of Your Personal Data.

(b) If You are not satisfied with Our response, You have the right to file a complaint with the Data Protection Board of India.

(c) The complaint process is:

• (i) Submit complaint to Grievance Officer (Section 14.0);
• (ii) Acknowledgment within forty-eight (48) hours;
• (iii) Resolution within thirty (30) days;
• (iv) If unresolved, escalate to Data Protection Board of India.

9.7 Right to Nominate (Section 14)

(a) You have the right to nominate any other individual who shall, in the event of Your death or incapacity, exercise Your rights under this Policy.

(b) Nomination can be made through: Settings > Privacy > Nominate Representative.

10.0 CHILDREN'S DATA

10.1 Compliance with Section 9, DPDP Act 2023

(a) HomeLift processes children's data (school information, schedules) solely at the direction of and with the verifiable consent of the child's parent or legal guardian.

(b) We do NOT permit children under the age of eighteen (18) to create accounts independently.

(c) All children's data is entered and managed exclusively by the parent/guardian account holder.

10.2 Verifiable Parental Consent

(a) Before any children's data is collected, We obtain verifiable parental consent through:

• (i) OTP verification to the parent's registered phone number;
• (ii) Explicit in-app consent screen clearly describing the data to be collected and its purpose;
• (iii) Consent records are maintained with timestamp and method.

(b) Parents/guardians may withdraw consent for children's data processing at any time through: Settings > Family > [Child Name] > Remove Child Data.

10.3 Restrictions on Children's Data Processing

In compliance with Section 9 of the DPDP Act, 2023:

(a) We do NOT process children's data in any manner that is likely to cause detrimental effect on the well-being of the child;

(b) We do NOT undertake tracking, behavioral monitoring, or targeted advertising directed at children;

(c) We do NOT share children's data with any third party except as strictly necessary for the specified purpose (school schedule management);

(d) Children's data is stored with enhanced encryption and access controls (see Section 12.0);

(e) We do NOT use children's data for AI model training or analytics beyond aggregate, anonymized usage statistics.

10.4 Data Minimization for Children

(a) We collect only the minimum data necessary for school schedule management:

• Child's first name (or nickname);
• School name;
• Class/grade;
• School timings;
• Transport details (optional).

(b) We do NOT collect: child's photograph, date of birth, academic records, health information, or social interactions.

10.5 Automatic Deletion

(a) If a parent/guardian removes a child from their account, all associated children's data is permanently deleted within seven (7) days.

(b) When a child reaches the age of eighteen (18) (if date of birth is provided), We will notify the parent/guardian and request confirmation to either delete the data or transfer management to the now-adult individual.

11.0 COOKIES AND TRACKING TECHNOLOGIES

11.1 Technologies Used

The HomeLift Platform (including web views within the mobile app) uses the following tracking technologies:

11.2 Cookie Categories

(a) Strictly Necessary: Required for the Platform to function. Cannot be disabled. Includes security cookies and authentication tokens.

(b) Functional: Enable enhanced functionality and personalization. Includes language preferences and UI settings.

(c) Analytics: Help Us understand how the Platform is used. Includes Firebase Analytics events.

11.3 Managing Tracking Preferences

(a) Analytics tracking can be disabled through: Settings > Privacy > Analytics > Disable.

(b) Disabling analytics does not affect core Platform functionality.

(c) Strictly necessary cookies cannot be disabled as they are essential for security and basic functionality.

11.4 Do Not Track

(a) HomeLift respects the "Limit Ad Tracking" (iOS) and "Opt out of Ads Personalization" (Android) device settings.

(b) We do not serve advertisements and therefore do not participate in ad tracking networks.

12.0 SECURITY MEASURES

12.1 Technical Measures

We implement the following technical security measures to protect Your Personal Data:

(a) Encryption at Rest:

• All database records encrypted using AES-256-GCM;
• Encryption keys managed through AWS Key Management Service (KMS);
• Separate encryption keys per data category (health, financial, children's data);
• Key rotation every ninety (90) days.

(b) Encryption in Transit:

• TLS 1.3 enforced for all API communications;
• Certificate pinning implemented in mobile applications;
• HSTS (HTTP Strict Transport Security) enabled with max-age of one (1) year;
• Perfect Forward Secrecy (PFS) enabled on all endpoints.

(c) Access Controls:

• Role-Based Access Control (RBAC) with principle of least privilege;
• Multi-Factor Authentication (MFA) required for all internal access;
• Row-Level Security (RLS) enforced at database level (Supabase);
• API authentication via JWT with short-lived tokens (1 hour expiry);
• Refresh tokens with device binding and rotation on use.

(d) Network Security:

• Web Application Firewall (WAF) via Cloudflare;
• DDoS protection (Cloudflare Enterprise);
• Rate limiting on all API endpoints;
• IP allowlisting for administrative access;
• Network segmentation between production and development environments.

(e) Application Security:

• Input validation and sanitization on all user inputs;
• Parameterized queries to prevent SQL injection;
• Content Security Policy (CSP) headers;
• Regular dependency vulnerability scanning (automated daily);
• Static Application Security Testing (SAST) in CI/CD pipeline.

12.2 Organizational Measures

(a) Personnel:

• Background verification for all employees with data access;
• Mandatory annual data protection training;
• Confidentiality agreements with all employees and contractors;
• Access provisioned on need-to-know basis and reviewed quarterly.

(b) Policies and Procedures:

• Information Security Policy (ISO 27001 aligned);
• Data Classification Policy;
• Incident Response Plan;
• Business Continuity and Disaster Recovery Plan;
• Acceptable Use Policy for employees.

(c) Audits and Assessments:

• Annual third-party security audit (penetration testing);
• Quarterly internal vulnerability assessments;
• Annual Data Protection Impact Assessment (DPIA) for high-risk processing;
• Continuous automated security monitoring and alerting.

12.3 Physical Security

(a) All data is hosted in Tier III+ data centers (AWS Singapore, Google Cloud US) with:

• 24/7 physical security and surveillance;
• Biometric access controls;
• Environmental controls (fire suppression, climate control);
• Redundant power and network connectivity.

(b) RUVIENT Technologies does not maintain on-premises servers containing Personal Data.

13.0 DATA BREACH NOTIFICATION

13.1 Breach Detection

(a) We maintain continuous monitoring systems to detect potential Data Breaches, including:

• Intrusion Detection Systems (IDS);
• Security Information and Event Management (SIEM);
• Anomaly detection on data access patterns;
• Automated alerts for unauthorized access attempts.

13.2 Notification to Data Protection Board

In compliance with Section 8(6) of the DPDP Act, 2023:

(a) Upon becoming aware of a Personal Data Breach, We will notify the Data Protection Board of India within seventy-two (72) hours;

(b) The notification will include:

• (i) Nature of the breach and categories of data affected;
• (ii) Approximate number of Data Principals affected;
• (iii) Likely consequences of the breach;
• (iv) Measures taken or proposed to address the breach;
• (v) Contact details of the Grievance Officer.

13.3 Notification to Affected Data Principals

(a) We will notify affected Data Principals without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach;

(b) Notification will be provided through:

• (i) In-app notification;
• (ii) Email (if available);
• (iii) SMS to registered phone number;
• (iv) WhatsApp message (if opted in).

(c) The notification will include:

• (i) Description of the breach in plain language;
• (ii) Categories of data affected;
• (iii) Likely consequences;
• (iv) Measures taken to address the breach;
• (v) Recommendations for protective steps You can take;
• (vi) Contact details for further information.

13.4 Breach Response Procedure

(a) Containment (0-4 hours): Isolate affected systems, revoke compromised credentials, preserve evidence;

(b) Assessment (4-24 hours): Determine scope, identify affected data and individuals, assess risk;

(c) Notification (24-72 hours): Notify Data Protection Board and affected individuals;

(d) Remediation (72 hours - 30 days): Implement fixes, enhance controls, conduct root cause analysis;

(e) Review (30-90 days): Post-incident review, update security measures, document lessons learned.

14.0 GRIEVANCE OFFICER

14.1 Appointment

In compliance with Section 13(3) of the DPDP Act, 2023, and Rule 5(9) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, We have appointed the following Grievance Officer:

Name: [Grievance Officer Name] Designation: Data Protection & Grievance Officer Organization: RUVIENT Technologies Private Limited Email: grievance@ruvient.com Phone: [Phone Number] Address: [Registered Office Address], India

14.2 Grievance Redressal Process

(a) Submission: Grievances may be submitted via:

• Email to grievance@ruvient.com;
• In-app: Settings > Help > File a Grievance;
• Written letter to the registered office address.

(b) Acknowledgment: Within forty-eight (48) hours of receipt.

(c) Investigation: The Grievance Officer will investigate the complaint and may request additional information from You.

(d) Resolution: Within thirty (30) days of receipt of the grievance, or such extended period as may be communicated with reasons.

(e) Escalation: If You are dissatisfied with the resolution, You may:

• (i) Request escalation to the Chief Executive Officer;
• (ii) File a complaint with the Data Protection Board of India;
• (iii) Approach the appropriate court of competent jurisdiction.

14.3 Grievance Officer Responsibilities

The Grievance Officer is responsible for:

(a) Receiving and acknowledging all data protection complaints; (b) Investigating complaints and coordinating with relevant teams; (c) Ensuring timely resolution within statutory timelines; (d) Maintaining records of all grievances and their resolution; (e) Reporting to the Data Protection Board as required; (f) Conducting periodic reviews of data protection practices.

15.0 CHANGES TO THIS POLICY

15.1 Modification Rights

(a) We reserve the right to modify this Privacy Policy at any time to reflect changes in:

• (i) Applicable Law or regulatory guidance;
• (ii) Our data processing practices;
• (iii) The features and functionality of the Platform;
• (iv) Third-party processors engaged.

15.2 Notification of Changes

(a) Material Changes: For changes that materially affect Your rights or the processing of Your Personal Data, We will:

• (i) Provide at least thirty (30) days' advance notice;
• (ii) Notify You through in-app notification, email, and/or SMS;
• (iii) Require re-consent where the change involves new processing purposes or new categories of data.

(b) Non-Material Changes: For minor changes (typographical corrections, formatting, clarifications that do not alter meaning), We will update the "Last Updated" date and version number without individual notification.

15.3 Continued Use

(a) Your continued use of the Platform after the effective date of a modified Policy constitutes acceptance of the modified terms, except where re-consent is required.

(b) If You do not agree with the modified Policy, You must discontinue use of the Platform and may request account deletion (Section 9.3).

15.4 Archive

Previous versions of this Privacy Policy are available at https://homelift.app/legal/privacy-policy/archive and upon request to privacy@ruvient.com.

16.0 GOVERNING LAW AND JURISDICTION

16.1 Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of India, including but not limited to:

(a) The Digital Personal Data Protection Act, 2023; (b) The Information Technology Act, 2000; (c) The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; (d) The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; (e) Any rules, regulations, or notifications issued by the Central Government or the Data Protection Board of India.

16.2 Jurisdiction

(a) Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.

(b) This is without prejudice to Your right to approach the Data Protection Board of India for complaints under the DPDP Act, 2023.

16.3 Regulatory Compliance

(a) In the event of any conflict between this Policy and Applicable Law, the provisions of Applicable Law shall prevail.

(b) If any provision of this Policy is found to be inconsistent with Applicable Law, that provision shall be deemed modified to the minimum extent necessary to achieve compliance, and all other provisions shall remain in full force and effect.

17.0 CONTACT INFORMATION

17.1 Data Fiduciary

RUVIENT Technologies Private Limited [Registered Office Address] [City, State, PIN Code], India CIN: [Company Identification Number]

17.2 Contact Channels

17.3 Response Times

ACKNOWLEDGMENT

By using the HomeLift Platform, You acknowledge that You have read, understood, and agree to be bound by this Privacy Policy. If You do not agree with any part of this Policy, please do not use the Platform.

RUVIENT Technologies Private Limited Document ID: RUVIENT-LEGAL-PP-2026-002 Classification: Public Effective Date: 20 May 2026 Next Review Date: 20 November 2026

© 2026 RUVIENT Technologies Private Limited. All rights reserved.

© 2026 RUVIENT Technologies Private Limited · Privacy · Terms · Delete account