PRIVACY POLICY AS UPDATED ON 01 June 2026.

At CTRUH, our mission is to enable Users to create, design, and deploy digital assets and immersive experiences using AI-powered and extended reality (XR) technologies. Our Platforms enables Users to generate and interact with 3D assets, augmented reality (AR) experiences, virtual try-ons, and other AI-driven outputs, allowing Users to visualise products, manage digital content, and build interactive storefronts and experiences with efficiency and consistency.

We respect your privacy and care about how your Personal Data is used. This Privacy Policy (the “Policy”) outlines how Ctruh Technologies Private Limited (“Company” or “us” or “we” or “our”) including our affiliates collect, use, store, process, transfer, and disclose your information through our Website https://www.ctruh.com/ (“Website”), our Software including AI-feature Versa AI, our Services, and any of our other websites, or any other services we offer from time to time by or in connection therewith (the “Platform”). This Policy governs access to and use of the Platform, which enables Users to create, upload, process, and manage digital assets, including images, product data, and other content, and to generate 3D models, augmented reality (AR) experiences, virtual try-ons, and other AI-driven outputs through the Platform's AI-features. The Platform further includes the CTRUH Editor, a 3D asset creation and editing environment, and the CTRUH Marketplace, a platform for buying, selling, and showcasing 3D assets, images, and embedded video content. Data generated through use of the CTRUH Editor and Marketplace, including asset modifications, listing activity, transaction records, and fetch interactions between Platform features, is collected and processed in accordance with this Policy. The Platform may also enable Users to store, organise, and deploy such assets and experiences across digital environments, including interaction with features such as visualisers, configurators, and immersive storefronts (the “Services”). By reviewing this Policy, you will gain a comprehensive understanding of your privacy rights and choices.

Your access to or utilisation of our Platform and/or Services operated by the Company linked to this Policy implies your agreement to be governed by this Policy. By providing us with your Personal Data, you expressly consent to the use and disclosure of your Personal Data as outlined in this Policy. This Policy, along with the Terms of Service, is applicable to your use of the Services, and you explicitly agree and acknowledge to read the Privacy Policy in conjunction with the Terms of Service.

Please note that the capitalised terms not defined in this Policy are defined in the Terms of Service.

The term “Personal Data” shall mean any information that relates to an identified or identifiable individual or entity. This may include, but is not limited to, information that you voluntarily provide to us (such as your name, email address, phone number, or professional details) and information that we collect automatically through your use of our Platform or Services (such as IP address, location, device identifiers, browser type, and usage data). “Personal Data” shall include equivalent terms in other Data Protection Laws, such as the GDPR-defined term “Personal Information,” as the context requires.

For this Policy or any other Platform policies, “Data Controller” shall mean the individual or entity who, alone or jointly with others, determines the purpose and means of collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of Personal Data and shall include the meaning assigned to the term in the applicable Data Protection Laws. Similarly, “Data Processor” shall mean the person who processes Personal Data on behalf of the Controller and shall include equivalent terms in other Data Protection Laws, as the context requires.

By accessing and using the Platform and/or Services, or furnishing your Personal Data, you explicitly agree and acknowledge that you accept the terms delineated in this Policy. The terms “Users”, “you”, or “your” mean any natural or legal person or entity who accesses or utilises the Platform or Services, including but not limited to the Authorised User of the entity, depending on the context in which the Platform or Services are accessed or used.

By visiting the Platform or providing your information, you expressly agree to be governed by the privacy laws of the India as well the United States, including but not limited to the Digital Personal Data Protection Act, 2023 (DPDPA), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and any other relevant regulations governing data protection and privacy (collectively, “Data Protection Laws”).

IF YOU DO NOT CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL DATA AS SET FORTH IN THIS PRIVACY POLICY, PLEASE REFRAIN FROM ACCESSING AND/OR USING OUR PLATFORM.

1. TO WHOM DOES THIS POLICY APPLY?

This Policy is inclusive and applies to all Users of our Platform and/or Services, irrespective of their browsing intent or their extent of using the Services offered on our Platform.
The applicability of this Policy extends to users regardless of the device type used for accessing our Platform and/or Services, whether it be a laptop/desktop or a mobile/tablet device.

2. WHAT IS THE INFORMATION THAT WE COLLECT FROM YOU?

To access and use our Services, the Users are required to provide the following information to the Company at the time of setting up their Account or at different instances, including, without limitation:
Basic Information: This will include full name, company name, addresses, and professional roles or designations;
Contact Information: This includes your email address, phone number, and, where voluntarily provided, links to your professional or social profiles (such as LinkedIn, Instagram, or similar platforms);
Verification Data: We implement verification and security measures at the time of Account creation and login, including One-Time Password (OTP) verification, and may collect related information solely to validate user identity, Account access, and system login;
Communication with Us: Any communications or interactions with us, including emails, support requests, onboarding discussions, demo bookings, or security notifications. This may include description of issues or queries, and any attachments or materials submitted (including screenshots, images, or other files uploaded through support or reporting features, where you may upload multiple files). We may also collect and process recordings or transcripts of onboarding sessions, demos, training sessions, or other interactions, in accordance with applicable laws;
Sensitive Information: If uploaded, shared, or generated through your use of the Platform, we may collect certain sensitive information, including but not limited to biometric data such as voice recordings or facial recognition, images or videos through device camera access, user-uploaded photos or media, and audio or conversational inputs provided to AI-features. This may include voice logs, facial expressions, gestures, speech patterns, and audio-visual cues captured during interactions with the Platform. Such information is collected only with your explicit consent or as otherwise authorised by you or the User, and is handled in accordance with applicable Data Protection Laws;
Payment and Financial Information: We may receive limited payment-related information, payment ID, or other invoicing particulars. You understand and agree that payments may be processed through a third-party Payment Processor, including Razorpay, Paypal, or via credit/debit cards. Such transactions are governed by the respective provider's terms and policies. The Company does not store sensitive payment details and is not responsible for payment failures, delays, or security issues attributable to third-party providers.
Device and Technical Information: This includes information that may assist us in identifying your device, including browser type and version, session logs, IP address, login timestamps, and software usage patterns, etc.;
Administrative and Configuration Activity Data: This includes logs and records relating to administrative actions performed on the Platform, such as creation, modification, or deletion of User Content, configuration of access controls, permissions, integrations, subscription settings, and security-related changes.
Interaction with AI-feature: This includes any prompts, commands, or inputs provided by you while using the Platform or its AI-features, including text inputs, image uploads, video inputs, audio prompts, camera access data, and any instructions or configurations provided by you. It also includes AI-generated outputs and any data collected, processed, or inferred from such interactions, including during use of features that capture or process visual, audio, or conversational inputs;
CTRUH Editor and Marketplace Activity Data: This includes assets uploaded to or fetched from the CTRUH Editor, modifications made within the Editor (including shape, size, texture, and configuration changes), assets published or transferred to the Marketplace or Studio, listing details, transaction records, purchase and sale history, and embedded content links (including YouTube embeds) submitted through the Marketplace;
Data from Social Networks: If voluntarily provided with social media account links then we also collect your information from social networking sites, such as Linkedin or Instagram including your name, your social network username, location, gender, birth date, email address, profile picture, and public data for contacts;
Additional Information: It includes, without limitation, when you voluntarily provide during participation in feedback surveys, service demos, webinars, support queries, or beta-testing initiatives.
Other Data: This can include the following, based on your interaction with the Platform and/or Services:
Number of times you access our Platform and/or Services;
The length of time you spent on the Platform;
Your engagement patterns, including the time when you became active and have continued to be active on the Platform;
In-Platform actions and interactions;
Other similar statistics we may collect with the intention of improving the user experience of the Platform.
You agree to provide us with your Personal Data whenever you use our Services by performing any of the following functions:
Accessing our Platform and/or Services by means of any web browser or any device;
Signing in and registering for our Services;
Inquiring about our Services through our Platform;
Initiating and maintaining correspondence with us; and
Interacting with our Platform or utilising the Services, which includes inputting data, receiving outputs, and engaging with personalised recommendations and insights.
You understand and agree that all Personal Data, sensitive or otherwise, collected through our Platform is provided solely by the User. Users are responsible for the accuracy and completeness of the information they provide.
By signing in with Google or Microsoft, you authorise the Platform to access and use this information solely for the purpose of creating, maintaining, and managing your Account in accordance with our Terms and this Privacy Policy . The Platform does not access any other information from your Google account, such as contacts, files, or calendar data.
We strive to take additional precautions to ensure that such Personal Data is kept secure and confidential, and we retain this data only for as long as is necessary to fulfil the purposes for which it is collected, in accordance with applicable laws. The Company stores and uses all Personal Data solely for the purpose of providing the Services and does not use such Personal Data for any unrelated or commercial activities without your additional, explicit consent.
Further, you understand and acknowledge that, to operate and provide the Platform and Services, we utilise certain trusted third-party service providers as mentioned in Clause 6. While we manage your Personal Data in accordance with this Policy, certain data may be processed by these third-party service providers solely for the purpose of enabling the Services. By using our Platform and Services, you acknowledge that you are bound by the terms and policies of our third-party service providers. We prioritise user privacy and security by relying on trusted third-party service providers, and we encourage Users to review and understand the policies of these platforms to protect their interests.
You understand that our payment partner, Razorpay or Paypal, provides you with the convenience of storing your payment methods on the Platform. By opting for this feature, you consent to the storage of your Personal Data, including your payment method.
This Policy will not apply to any unsolicited information provided by you through the Platform or through any other means. This includes but is not limited to information posted on any public areas of the Platform and other social media. All such unsolicited information shall be deemed to be non-confidential, and we will be free to use and disclose such unsolicited information without limitation.
For Users opting for customised or Enterprise Custom Plans, payments may be processed outside the Platform. In such cases, invoicing, billing, and payment processing may be handled offline or through third-party service providers, and the processing of any payment-related or financial information shall be governed by the applicable terms agreed between the parties and the policies of such third-party providers. We shall not be liable for any loss or damage sustained by you as a result of any disclosure (inadvertent or otherwise) of payment-related information shared by you through offline or external invoicing and billing processes, including invoices raised through third-party accounting or payment service providers. For this purpose, you are advised to review the terms of service and privacy policies of such third-party service providers, as the handling of payment-related information by them is governed by their respective policies.
Access to your Personal Data is limited to employees, agents, partners, and third parties, who we reasonably believe will need that information to enable us to provide Services to you. However, we are not responsible for the confidentiality, security, or distribution of your own Personal Data by our partners and third parties (who have their own privacy policies) outside the scope of our agreement with such partners and third parties.
When you use our Platform, we collect and store your information, which is provided by you from time to time. In general, you can browse the Platform without telling us who you are or revealing any Personal Data about yourself. Once you give us your Personal Data, you are not anonymous to us. Where possible, we indicate which fields are required and which are optional. You always have the option to not provide information by choosing not to use a particular service, product, or feature on the Platform.

3. HOW DO WE COLLECT THE INFORMATION?

We employ various methods to gather information, ensuring a comprehensive understanding of user interactions and preferences. The collection of Personal Data is facilitated through the following processes:
Information you give us: When you provide us with the information referred to in Sections 2.1 through the methods outlined in Section 2.2;
Session Management: We study session metrics to understand how Users interact with the Platform. This helps us learn the average time Users spend on the Platform and when they prefer to engage. We use tools like Google Analytics or CRM Hubspot (or alternatives), any other tool used by the company to collect anonymous data, including the number of views, how long Users stay, and where they're visiting from. This data allows us to optimise the user experience, making informed enhancements to cater to user preferences and behaviors.
User analytics: We analyse User behavior and preferences by collecting, processing and analysing Personal Data across our Platform. This helps us maintain accuracy, promptly identify any unusual behavior, and detect fraudulent activities across all managed platforms. By tracking interactions, we ensure that corrective actions are taken immediately to protect both our own systems and those of our Users, while optimising the overall user experience.
In addition to direct User interactions, we utilise various browser-based and server-side data collection methods to enhance User experience, ensure Platform security, and optimise the performance and reliability of the Platform. These methods assist in maintaining secure access, monitoring Platform usage, supporting deployments, and improving the functionality of the Services. The Platform is primarily accessed through web browsers on desktop or laptop devices, and the data collection methods described below apply to browser-based access and server-side operations. Users may manage certain data preferences through their browser settings, where applicable. Below are the categories of data collection methods used in our Platform, along with a description of what they are used for:
Essential Data Storage: These are necessary for the operation of the Platform and to ensure its security and proper functioning. They may include session cookies, authentication tokens, and similar technologies required to enable core functionalities such as account login and transaction processing.
Functional Data Storage: These mechanisms remember user preferences within the Platform such as your region or country, preferred language, and accessibility options like large font or high-contrast pages. They ensure the Platform functions according to your preferences every time you use it.
Analytics and Performance Tracking: We use analytics tools and similar technologies to collect aggregated information about how Users interact with the Platform, including pages visited, features used, time spent, and navigation patterns. This helps us analyse trends, improve functionality, and enhance user experience.
Event Tracking: The Platform may define and record system-generated and User-initiated events that occur within the web-based Platform to understand how specific features are accessed and used. Such events may include creating or modifying digital assets or experiences, using AI-features, initiating or interacting with AR/VR experiences or virtual try-ons, uploading or managing content (including images, videos, or 3D assets), configuring product settings or storefronts, uploading, editing, or publishing assets through the CTRUH Editor, including shape, size, and texture modifications; listing, purchasing, or selling assets through the Marketplace; and fetch interactions between CTRUH Studio, the CTRUH Editor, and the Marketplace, and interacting with AI-generated outputs or responses;
Log Files: Our servers automatically collect certain technical information transmitted by Users' browsers when they access the Platform, commonly referred to as log files. This information may include IP addresses, browser type, operating system, date and time of access, and requested pages. Log files are used for security monitoring, analysing usage trends, administering the Platform, and diagnosing technical issues;
Location Data: The Platform does not collect precise GPS-based location data or device-level location permissions. Any location-related information collected is limited to coarse or inferred data (such as country or region) derived from IP addresses, solely for security, compliance, or access-control purposes.
Third-Party Web SDKs and Infrastructure Services: The Platform integrates certain third-party web-based software development kits and infrastructure services to support analytics, communications, monitoring, and operational functionality. These services may collect limited technical and usage data necessary to deliver the Services in a secure and reliable manner, in accordance with this Policy and the respective third-party providers' privacy policies.
In addition to direct user interactions and the data collection mechanisms described above, we leverage cookies and similar technologies to enhance the functionality and user experience on the Platform. These allow us to collect and process additional information for various purposes. You may reject all non-essential cookies through the cookie banner displayed on our Platform (subject to geographic availability) or through the relevant browser settings. If you choose to reject non-essential cookies, only cookies that are strictly necessary for the functioning of the Platform will be enabled. You may also configure your browser to refuse cookies or delete existing cookies; however, please note that disabling cookies may result in certain features of the Platform not functioning as intended:
Cookies: We utilise cookies, which are small text files stored by your web browser on your device. These cookies help us and third parties identify Users, track preferences, analyse usage patterns, and optimise the Platform's functionality to provide a customised experience. Cookies enable us to store preference information and understand browsing activities. You may manage cookie preferences through your browser settings. Below is the limited list of the categories of cookies we use, along with their purposes:
Strictly Necessary Cookies: These cookies are needed to run our Platform, to keep it secure if you are logged in, and to obey regulations that apply to us. They also help us keep your details safe and private.
Functional Cookies: These cookies are used for remembering things such as your region or country, your preferred language, and accessibility options like large font or high-contrast pages.
Performance Cookies: These cookies provide aggregated information on how Users interact with the Platform. We combine all this data together and study it. This helps us to improve the performance of our Services and/or the Platform.
Session Cookies: We use session cookies, which are stored temporarily during your browsing session and deleted when you close your browser or application. These cookies support Platform functionality and help us analyse usage, including pages visited, links clicked, content viewed, and time spent on each page.
Analytics Cookies: Analytics cookies collect data about your use of the Platform, allowing us to improve its performance. These cookies provide aggregated information to monitor Platform functionality, track page visits, identify technical issues, analyse user traffic, and improve Service performance.
Purpose of Cookies We Use: We utilise Personal Data obtained through cookies to enhance the speed, security of your interaction with us, and overall user experience. These cookies serve various purposes:
Preferences: Cookies enable the Platform to remember information that alters the site's behavior or appearance, such as your preferred language or geographic region. By retaining your preferences, we can customise the presentation and functionality of the Platform.
Security/Optimisation: Cookies play a crucial role in maintaining security by verifying Users, preventing fraudulent use of Services, and safeguarding User data from unauthorised access. Specific types of cookies assist in blocking various types of attacks, such as attempts to pilfer content from Platform forms.
Processing: Cookies contribute to the efficient functioning of the Platform, allowing us to deliver the Services expected by visitors and/or Users. These cookies facilitate tasks like navigating web pages and accessing secure sections of the Platform.
Communication: Information collected through cookies may be utilised to communicate with you, including sending newsletters, seeking your opinions and feedback, and providing Services and promotional materials.
Analytics and Research: Cookies aid in comprehending how individuals utilise our Services, enabling us to enhance them for a better user experience. This data-driven insight helps us refine and improve our offerings.
Web Beacons, Pixel Tags, and Trackers: We may use web beacons, pixel tags, or similar technologies on the Platform and in service-related communications to understand how Users interact with specific pages, features, or messages. These technologies are small graphic elements or blocks of code that help us determine whether a page has been accessed or a communication has been opened. The information collected through these tools is used solely to monitor Platform usage, improve functionality, assess the effectiveness of service-related communications, and support operational analytics, and is not used for behavioural advertising or targeted marketing unless expressly disclosed.
Metadata: When you interact with our Platform, including while using AI-features, initiating or engaging with XR-based functionalities (such as AR experiences, virtual try-ons, or 3D generation tools), or uploading or providing inputs through camera access, audio prompts, video inputs, text, or other media, we may collect certain metadata to enhance and optimise the functioning of the Platform and Services. Such metadata may include interaction timestamps, types or categories of queries or commands, response times, and technical information transmitted by your browser, such as IP addresses, browser type, operating system, and usage patterns. This metadata is used solely for operational purposes, performance monitoring, system reliability, and improvement of accuracy and Platform functionality, and is not used for profiling, behavioural advertising, or targeted marketing unless expressly disclosed.
Information from Other Sources: We may collect Personal Data from other sources, including but not limited to:
If a User or any third party submits a complaint about you, we may receive information relating to the specific complaint made in order to understand and, where relevant, address the complaint; and
To the extent permitted by applicable law, we may receive additional information about you, such as references, demographic data, and information to help detect fraud and safety issues from (i) third-party service providers, other third parties, and/or partners, or (ii) Users and any other individuals, entities, and authorities, and combine it with information we have about you. For example, we may receive background check results or fraud warnings from identity verification service providers for use in our fraud prevention, security investigation, and risk assessment efforts. We may receive information about you and your activities on and off the Platform, including from Users of our Platform, members of the public, governmental, public, or tax authorities, or about your experiences and interactions with our partners.

4. WHY DO WE COLLECT YOUR INFORMATION?

We shall collect your information only for lawful and legally permissible purposes, which are as follows:
Contractual Necessity: We process your Personal Data to fulfil our contractual obligations with you, which include, without limitation, providing access to the Platform, enabling secure access through third-party authentication systems (such as Google or Microsoft Single Sign-On), verifying user identity, managing user roles and access permissions, configuring Platform settings, supporting integrations with User's systems, and providing technical support, maintenance, and related Services.
User Authentication: We collect your information to help us identify you as and when you access the Platform, when you register an Account with us or log in, or when you utilise our Services;
Conversation Context Creation: We collect Personal Data and related usage data provided by you, including inputs, prompts, configuration settings, AI-feature interaction data, uploaded content (such as images, videos, 3D assets, or product data), and other information submitted through the Platform, for the purpose of generating AI-driven outputs, including 3D models, virtual try-ons, AR/XR experiences, visualisations, and other immersive or interactive content, improving AI-feature performance and contextual accuracy within the Platform, supporting content generation, processing, and feature functionality, and adapting Platform functionality based on your usage preferences, enabled features, and authorised configurations;
Research and development: We will utilise Personal Data to deliver the Services and to develop, test, and enhance the quality and usability of both the Platform and Services. Our primary approach will involve de-identifying this information before utilisation, and subsequently integrating it with de-identified browser data for these purposes;
Communicate with you: We use your Personal Data to communicate with you concerning our Services via different channels (e.g., by phone, e-mail, chat);
Fraud Prevention and Credit Risks: We use your Personal Data to prevent and detect fraud and abuse to protect the security of our Users;
Troubleshoot Problems: We use your Personal Data to provide functionality, analyse performance, fix errors, and improve the usability and effectiveness of the Platform and/or Services;
Compliance with law: To be able to perform any contractual and legal obligation;
Enhancing User Experience: To analyse User behavior and preferences for improving our Services and User experience, and to be able to provide location-specific services, if any;
Transactions and Payments: To facilitate secure and efficient payment processing, as well as handle transactions related to Services on the Platform. Also, Personal Data is utilised to enable or authorise payment services, including detecting and preventing money laundering, fraud, abuse, and security incidents, complying with legal obligations, enforcing payment policies, and improving payment services;
Recommendations and Personalisations: We use your Personal Data to recommend features, products, and Services that might be of interest to you, identify your preferences, and personalise your experience with the Website and/or Services;
Enhanced Advertising and Marketing Efforts: In our efforts to provide, personalise, measure, and enhance our advertising and marketing endeavours, we engage in several key activities. Firstly, we utilise User information to send promotional and marketing messages, tailoring them to suit individual preferences and interests. Additionally, we strive to customise and optimise advertising on various platforms to ensure relevance and effectiveness. Furthermore, we may administer referral programs, rewards, surveys, sweepstakes, contests, and other promotional activities to engage Users and foster community participation. Through the analysis of User characteristics and preferences, we aim to send targeted promotional messages that resonate with each User segment. Finally, we extend invitations to Users for events and relevant opportunities, enriching their overall experience with our Platform; and
Providing alerts/notifications: To effectively communicate with you through emails/SMS/notifications through the Platform to inform you about any other new apps or services that we may, from time to time, develop.
You consent to us processing your Personal Data in specific situations, particularly where it is required to deliver our Services. Wherever Data Protection Laws require us to collect and process certain Personal Data based on your consent, we will obtain this consent at the time of data collection. Your Personal Data may also be disclosed on our Platform if authorised by you for the purpose of utilising our Services. Additionally, we may communicate with you through various means, including messaging, calls, or emails, through third-party service providers to facilitate the performance of our Services where necessary. Furthermore, your Personal Data may be processed to the extent required to comply with legal obligations.

5. HOW YOUR DATA IS USED TO IMPROVE AI-FEATURE (VERSA AI) PERFORMANCE WITHIN THE PLATFORM?

We may use content provided, uploaded, or generated by you while using the Platform, including inputs, prompts, configurations, User Content, and AI-generated outputs, to improve, develop, and train our AI-features. You may opt out of the use of your content for AI-feature training and improvement through the settings or mechanisms provided on the Platform.
Even if you have opted out of training, you may choose to provide feedback regarding your interactions with the Platform or its AI-features. If you provide such feedback, the associated interaction data and content may be used to improve and train our AI-features.
Where content is used for training or improvement purposes, we take reasonable steps to minimise the inclusion of Personal Data, including through de-identification, aggregation, or similar privacy-enhancing measures, in accordance with applicable Data Protection Laws.

6. WHO DO WE SHARE YOUR PERSONAL DATA WITH AND WHY?

To facilitate our Services and enhance user experience, we may share Personal Data with the following entities:
Third-party Service Providers:
We engage the services of third-party service providers to carry out various functions on our behalf, such as payment processing, data analysis, email communications, hosting services, storage, customer service, marketing assistance, etc. While these third-party service providers may have access to the necessary Personal Data to fulfil their functions, they are prohibited from using it for any other purposes. Moreover, they are obligated to process the Personal Data in compliance with applicable laws. While we do not own or control these third parties, when you interact with them and choose to use their services, you are providing your information to them.
You acknowledge that our AI-powered features are enabled through third-party API integrations (collectively, the “LLM Service Providers”). This third-party providers process the Personal Data, prompts, media, and interactions you input in order to generate responses and deliver AI functionalities. While we do not directly share your Personal Data with these providers, your inputs may be accessed and processed by them as part of their service delivery. To the best of our knowledge, these providers do not retain or use your data for model training or improvement unless explicitly stated in their respective privacy policies, agreed by you, or required by law. Most LLM Service Providers process input data solely for operational needs such as abuse monitoring, service reliability, and diagnostics. We encourage you to review the individual policies of these providers listed above to understand how your data may be handled during your use of AI-powered tools on our Platform. Your use of these services is subject to the privacy policies of those providers, including but not limited to the following:

Sr. No.	Service Providers	Purpose/Function	Links
1	Amazon Web Services	Cloud & Storage	http://aws.amazon.com
2	Razorpay	Payment Processor	https://razorpay.com/privacy-policy/
3	Paypal	Payment Processor	https://www.paypal.com/myaccount/privacy/privacyhub
4	Google Gemini	LLM Service Providers	https://policies.google.com/privacy

Employees and Independent Contractors: Employees and independent contractors of the Company have access to Personal Data strictly on a need-to-know basis for their job functions or contractual obligations. They comply with this Policy and are trained to protect Personal Data. Confidentiality obligations prohibit unauthorised disclosure or misuse of Personal Data. We monitor compliance and may enforce disciplinary action for breaches, ensuring appropriate security measures are in place to safeguard all accessed Personal Data.
Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honor this Policy. Affiliates may include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
Business Transfers: If we reorganise or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer your information to the successor entity. If we go out of business or enter bankruptcy, your information would be an asset transferred or acquired by a third party. You acknowledge that such transfers may occur and that the transferee may decline to honor commitments we made in this Policy.
Legal Compliance:
We may disclose your information to courts, law enforcement, governmental or public authorities, tax authorities, authorised third parties, or other Users, if and to the extent we are required or permitted to do so by law or where disclosure is reasonably necessary to: (i) comply with our legal obligations, (ii) comply with a valid legal request, such as a subpoena or court order, or to respond to claims asserted against Company, (iii) respond to a valid legal request relating to a criminal investigation to address alleged or suspected illegal activity, or to respond to or address any other activity that may expose us, you, or any other of our Users to legal or regulatory liability, (iv) enforce and administer our agreements with users, including our Terms, additional legal terms, and policies, (v) respond to requests for or in connection with current or prospective legal claims or legal proceedings concerning the Company and/or third parties, in accordance with applicable law, or (vi) protect the rights, property or personal safety of the Company, its employees, its user, or users of the public. Notwithstanding the above, you understand that before responding to any request for Personal Data, we conduct a thorough legal review to ensure the request complies with applicable laws, is specific, and is valid under the relevant legal framework. Requests that do not meet these criteria will not be processed. We reserve the right to seek clarification or additional information from the requesting authority if needed to validate the request.
Where legally required or permissible according to applicable law, we may disclose user information to relevant tax authorities or other governmental agencies, depending on where you are based, for the purpose of the tax authorities' determination of proper compliance with relevant tax obligations.
Furthermore, we adhere to a strict data minimisation policy, disclosing only the minimum amount of Personal Data necessary to comply with lawful requests. Before responding to any request, we thoroughly assess its scope to ensure only information specifically relevant and necessary to fulfil the legal requirement is disclosed. Additionally, any data irrelevant to the specific request is redacted or withheld. If data must be disclosed, it is shared in aggregate or anonymised form wherever possible to safeguard individual privacy.
We maintain detailed documentation of all requests from public authorities for user information to ensure accountability and transparency. This includes, without limitation,
the nature and content of the request,
verification of the requesting authority's credentials,
legal basis cited in the request (e.g., court orders, subpoenas, statutory authority),
internal legal review processes, including opinions sought from legal counsel,
specific information disclosed (if any) and the date of disclosure,
any communication with the requesting authority, including objections or clarifications sought, and
steps taken to comply with jurisdiction-specific laws and regulations.
Where appropriate and/or legally required, we may notify the User about legal requests, unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon or harm to us, our Users, or expose us to a claim of obstruction of justice. If a request for Personal Data is deemed unlawful, overly broad, or lacking in sufficient legal basis, we will take appropriate measures to challenge or refuse the request. This may include engaging with the requesting authority to clarify the scope of the request or initiating or participating in legal proceedings to challenge the request where warranted.
Service Improvement: We may share certain aggregated, anonymised information with third parties (for example, for Google Analytics) in order to assess the Platform usage and information pertaining to the ease of navigation.
Advertisements: We use third-party advertising companies to serve ads when you visit our Platform. These companies may use information (not including your name, address, email address, or telephone number) about your visits to the Platform and other websites in order to provide personalised advertisements about goods and services of interest to you.
Collaborations: We may share your Personal Data with reputable partners to facilitate joint initiatives, promotions, or integrated services; and
Growth and Expansion: As our Platform evolves and expands, there may be instances where sharing Personal Data with new entities or parties becomes necessary for the enhancement of our Services. Any such sharing will be carried out with the utmost consideration for user privacy and in accordance with relevant legal frameworks.
We do not ever sell or rent your Personal Data without your express approval.
We do not share Personal Data with advertisers or third-party sites displaying our interest-based ads. However, advertisers may infer user interests from interactions with ads and might provide us with demographic information to enhance ad relevance. Advertisers can serve ads directly to your browser, receiving your IP address, and may use cookies to evaluate ad effectiveness. We do not control these cookies or the practices of third-party advertisers, so please refer to their privacy policies for more information.
We are not responsible for the actions of third parties with whom you share personal or sensitive data, and we have no authority to manage or control third-party solicitations. If you no longer wish to receive correspondence, emails, or other communications from third parties, you are responsible for contacting the third party directly.
We are not responsible for the actions of third parties with whom you share personal or sensitive data, and we have no authority to manage or control third-party solicitations. If you no longer wish to receive correspondence, emails, or other communications from third parties, you are responsible for contacting the third party directly.

7. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

In compliance with applicable Data Protection Laws, we retain your Personal Data for a duration no longer than necessary for the purpose for which it was collected or as mandated by relevant Data Protection Laws. By default, your Personal Data is retained for a period of up to one (01) year from the date of lapse of your Subscription Plan or termination of Account, unless a shorter retention period is requested by the User or a longer retention period is mandated by applicable law, or regulatory guidelines.
You may request permanent deletion of your Account and all associated data at any time. Upon receiving such a verified request, we will initiate the deletion process and complete it within thirty (30) days, including purging of associated backups as part of our secure data sanitisation protocols. During this period, you may request to export or recover your data. In some cases, where immediate deletion is not feasible due to technical or legal constraints, we may instead anonymise your data to ensure it can no longer be linked to you, effectively removing all personal identifiers. The anonymised data may be retained solely for analytical and research purposes.
However, certain data related to you may be retained beyond its primary retention period if it is deemed reasonably necessary to prevent fraud, mitigate abuse, exercise our legal rights, defend against claims, or fulfil legitimate purposes as required by law. We may also retain your Personal Data for analytical and research purposes, or for purposes in the public interest. Additionally, we may retain your Personal Data for the following purposes:
Legitimate Business Interest: We may retain your Personal Data as necessary for our legitimate business interests, such as the prevention of money laundering, fraud detection and prevention, and enhancing safety. For example, if we suspend your access to our Services for fraud or safety reasons, we may retain information to prevent that User from accessing our Services again in the future;
Legal, Tax, Reporting, and Auditing Obligations: We may retain and use your Personal Data to the extent necessary to comply with our legal, tax, reporting, and accounting & auditing obligations;
Shared Information: Information you have shared with others, such as reviews and forum postings, may continue to be publicly visible on the Platform, even after your Account is cancelled; and
Residual Copies: Residual copies of your Personal Data (either in the form of De-Identified Information, Non-Identifying Information, or identified information) may remain in our backup systems, primarily to ensure compliance with legal obligations and to protect against accidental loss or destruction. However, non-identifiable usage patterns, data, and analytics may be retained for performance improvement of our Platform and/or Services. We strive to anonymise your data to prevent any personal identifiers from being linked to you. However, in rare cases where legal or operational requirements necessitate it, identifiable information may be retained temporarily. Such retention is strictly limited and governed by applicable laws.
You further acknowledge that while we manage your Personal Data in accordance with this Policy and do not permit its use for AI-feature training or improvement without your consent, your inputs and outputs may be accessed, processed, and temporarily stored by us or the relevant third-party service provider solely for purposes such as delivering requested functionality, ensuring service reliability, monitoring for misuse, or complying with legal obligations, in accordance with their respective policies. The retention practices applicable to such inputs and outputs may vary depending on the third-party service provider involved, and we do not control the specific retention periods adopted by these providers. By continuing to use features on the Platform, you acknowledge and agree to such third-party processing and retention practices and are encouraged to review the privacy policies, terms and conditions or other policy of the relevant third-party service provider for further details.

8. HOW DO WE PROVIDE FOR THE SECURITY OF YOUR PERSONAL DATA WITH US?

We prioritise the security of your Personal Data and have implemented industry-standard technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. All data transfers to and from our Platform are protected using Hypertext Transfer Protocol Secure (HTTPS) and TLS 1.2+, ensuring encryption via Secure Sockets Layer (SSL) technology. Data is encrypted both in transit and at rest, using industry-standard encryption mechanisms. Access to Personal Data is governed by strict access-control mechanisms, with multi-factor authentication enforced wherever possible. Access rights are granted on a least-privilege and need-to-know basis and are limited to a minimal number of authorised individuals.
In addition, we maintain reasonable administrative, electronic, and physical safeguards in alignment with globally recognised information security practices, ensuring the ongoing confidentiality, integrity, and availability of your Personal Data.
We work to protect the security of your Personal Data during transmission by using encryption protocols. We use multi-layered controls to help protect our infrastructure, constantly monitoring and improving our applications, systems, and processes to meet the growing demands and challenges of security. We ensure that the third parties who provide services to us under appropriate contracts take appropriate security measures to protect your Personal Data in line with our policies. We may update or modify such security measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Service.
The safety and security of your information also depend on you. Where we have given you (or where you have chosen) a password for access to Platform or certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Platform, like message boards, as the information you share may be viewed by any user of the Platform.
While we take comprehensive measures to safeguard your information, Users acknowledge and accept the inherent security implications of data transmission over the Internet and the World Wide Web. Despite our efforts, complete security cannot be guaranteed, and inherent risks persist. Users bear the responsibility of safeguarding login credentials for their Accounts. Any transmission of Personal Data is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained on the Platform. While acknowledging these risks, we remain committed to continually enhancing our security protocols to address emerging threats and maintain the trust of our Users.

9. HOW DO WE HANDLE DATA BREACHES AND SECURITY INCIDENTS?

Pursuant to Clause 8 of this Policy, we strive to prevent data breaches and security incidents to the best of our ability. However, should a data security breach occur, we have an incident response plan (“Incident Response Plan”) in place as outlined in this Clause. In the event of a data breach or security incident, the Company maintains a proactive approach to ensure swift resolution and mitigate potential risks. Additionally, we take appropriate measures to contain the impact of any breach while ensuring compliance with applicable Data Protection Laws.
We have established a comprehensive incident response plan designed to address such occurrences promptly and effectively:
Identification: We promptly identify and acknowledge any signs of a data breach or security incident within our systems or infrastructure;
Containment: Immediate action is taken to contain the impact of the breach, preventing further unauthorised access or damage to data;
Notification: We prioritise transparency by promptly notifying affected parties, including Users and relevant stakeholders, within a reasonable time of discovering the breach. The notifications will be communicated via email and will detail the nature of the breach and its potential impact on their data, along with support resources;
Collaboration: We collaborate with relevant authorities, such as regulatory bodies and law enforcement agencies, to report the incident and comply with any legal obligations or regulatory requirements; and
Post-Incident Assessment: Following the resolution of the incident, we conduct thorough assessments to evaluate the effectiveness of our response measures and identify areas for improvement. Our employees are trained on the Incident Response Plan to ensure preparedness and effective response.

10. DO WE TRANSFER YOUR PERSONAL DATA ACROSS THE BORDER?

Storage Information: User data is securely stored on our servers and databases, using third-party storage partners, including AWS. These servers are strategically located based on the User's location to minimise latency for each User. At present, our servers are located in the United States and/or India. However, this may change as we scale and transition to data centers in other jurisdictions, based on operational requirements.
While our primary practice is to store all data on servers located within the United States and/or India, it's important to note that certain circumstances may necessitate the transfer of your Personal Data to countries outside your residential country. These transfers may occur for various purposes outlined in this Policy.
You understand and accept that other countries may have differing (and potentially less stringent) laws relating to the degree of confidentiality afforded to the information it holds and that such information can become subject to the laws and disclosure requirements of such countries, including disclosure to governmental bodies, regulatory agencies, and private persons, as a result of applicable governmental or regulatory inquiry, court order or other similar processes. In addition, a number of countries have agreements with other countries providing for the exchange of information for law enforcement, tax, and other purposes.
If we transfer your Personal Data to third parties for purposes stated in this Policy, we will use our best endeavors to put in place appropriate controls and safeguards to ensure that your Personal Data is kept accurate, adequately protected, and processed only for specified and reasonable purposes in a manner that is fair, transparent and has a lawful basis, and is stored for no longer than is absolutely necessary.

11. WHO IS THE DATA CONTROLLER, DATA PROCESSOR AND DATA SUB-PROCESSOR OF YOUR PERSONAL DATA?

The Company will act as the Data Controller, where we make decisions on how your Personal Data is used in connection with the Platform or our Services. We will act as the Data Processor, where we only use your Personal Data as authorised and instructed by a third party in connection with the Platform or Services.
Where we are acting as the Data Controller, we are responsible for the obligations of a Data Controller under Data Protection Laws in connection with the processing of Personal Data of User, and we use this Privacy Policy to provide them with information about our use of your Personal Data.
Where we act as a Data Processor, the relevant third party, such as the User using the Platform, will act as the Data Controller. These third parties are responsible for fulfilling the obligations of a Data Controller under applicable Data Protection Laws in relation to the processing of your Personal Data. In instances where you access the Platform or our Services through a third party or where Users upload content or manage Personal Data of others, they serve as the Data Controllers. The Company processes this data strictly on their behalf, following their instructions and acting solely as a Data Processor. If you have any queries regarding the processing of your data by such third parties, you should contact the respective Data Controller directly for further information or clarification on their compliance with Data Protection Laws.
The third-party service providers identified under Clause 6 of this Policy act as sub-processors of the Company. Such Data sub-processors are engaged by the Company in its capacity as a Data Processor to process Personal Data solely on behalf of, and in accordance with, the documented instructions of the applicable Data Controller, and strictly for the purpose of enabling the operation and delivery of the Platform and Services. All Data sub-processors are contractually bound to comply with applicable Data Protection Laws, maintain appropriate technical and organisational safeguards, and process Personal Data only in accordance with the Company's contractual obligations and instructions.
You understand and acknowledge that the Company is the controller for the processing of your Personal Data. Our contact information is:
Address: 3rd Floor, Obeya Silk Siddappa Layout, Madiwala, Post, Bommanahalli, Bengaluru, Karnataka 560068
Email: support@ctruh.com
Contact No.: +917204221351

12. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

You, as a data subject, may have certain rights to your Personal Data with us, as under:

Request access to your Personal Data: This allows you to receive a copy of the Personal Data we hold about you, and to check that we are lawfully processing it;
Request the correction of your Personal Information: This allows you to ask for any incomplete or inaccurate information we hold about you to be corrected;
Request the erasure of your Personal Information: This allows you to ask us to delete or remove your Personal Information from our systems where there is no good reason for us to continue processing it;
Object to the processing of your Personal Information: This allows you to object to our processing of your Personal Data for a specific purpose (for example, for marketing purposes, for AI-feature training);
Request the transfer (data portability) of your Personal Information: This allows you to request the transfer of your Personal Data in a structured, commonly used, machine-readable format, either to you or to a third party designated by you and, if technically feasible, have it transmitted to another controller without any hindrance. This provision is applicable provided that your information is processed by automated means and that the processing is based on your consent, on a contract of which you are a part, or on pre-contractual obligations thereof;
Request the restriction: You have the right to request the restriction of the processing of your Personal Data. This means we will store your Personal Data but not further process it, except in limited circumstances (e.g., with your consent or for legal claims);
Request further information on the processing of your Personal Data: You have the right to obtain further information on how we process your Personal Data. This includes details about the purposes of the processing, the categories of Personal Data involved, the recipients or categories of recipients with whom the Personal Data has been or will be shared, and the envisaged retention period of the Personal Data.
Withdraw your Consent: This right only exists where we are relying on your consent to process your Personal Data. If you withdraw your consent, we may not be able to provide you with access to certain features of our Platform. We will advise you if this is the case at the time you withdraw your Consent.
Opting Out of Marketing Materials: You may object to our use of your Personal Information for marketing purposes. You can always opt out of this through the functionality provided in each marketing communication (e.g. by clicking “unsubscribe” at the bottom of an email).
Opting Out of AI Model Training: While we process your Personal Data and inputs to generate outputs and provide the Services requested by you, we may also use such Personal Data to develop, improve, and train our AI-features. You have the right to opt out of the use of your Personal Data for AI-features training at any time, either through the functionality made available on the Platform or by contacting us at support@ctruh.com. Upon exercising this option, your data will no longer be used for AI model training on a prospective basis, subject to technical and operational limitations.
User's State-Specific Rights:
If you are a citizen of India, you may have additional rights listed in Schedule I. Please refer to Schedule I below for more detailed information on your rights.
If you are a citizen of the European Union, you may have additional rights listed in Schedule II. Please refer to Schedule II below for more detailed information on your rights.
If you are residing in the United Kingdom, you may have rights listed in Schedule III. Please refer to Schedule III below for more detailed information on your rights.
If you are residing in the United States including states such as California, Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nevada, Oregon, Texas, Utah, Vermont, Virginia, or Washington, or are otherwise protected by privacy or consumer health data laws in those jurisdictions, please refer to Schedule IV that outlines state-specific rights and protections afforded to you.
Please note that these Schedules are supplemental to our Privacy Policy
In relation to the above, you can exercise such right by sending us an email with your request to support@ctruh.com along with the necessary proof of identity requirements that we may require prior to processing such a request from you.
We are committed to respecting and protecting your privacy and will make every effort to accommodate your requests and address your concerns in accordance with applicable laws. It's important to note that we may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. This ensures that your rights are upheld and that we respond to your inquiries promptly and effectively.
While we strive to cover the privacy rights of Users in various jurisdictions through this Privacy Policy and the accompanying Schedules, we understand that some Users may be in regions with specific Data Protection Laws that are not explicitly addressed here. If you are a User whose data subject rights are not clearly covered in this Privacy Policy or the Schedules, please reach out to us for assistance at support@ctruh.com. You can contact us to: (a) inquire about the processing of your Personal Data; (b) request access, rectification, or erasure of your Personal Data; (c) restrict or object to the processing of your Personal Data; and (d) exercise any other rights granted under applicable Data Protection Laws in your jurisdiction.
Please be aware that these rights are subject to legal restrictions. We will respond to your request as soon as possible, typically within one month at the latest. If you believe that our processing of your Personal Data is unlawful, you have the right to complain to the legal@ctruh.com. We hope that you will first contact us so that we can assess your objections and clarify any misunderstandings.

13. ARE CHILDREN ALLOWED TO USE OUR PLATFORM?

This Platform is strictly prohibited for use by individuals under the age of eighteen (18) years or the age of majority as defined by the applicable laws of their country of residence. Specifically, individuals under the age of sixteen (16) residing in European Union (EU) countries and those under thirteen (13) years old in the United States or United Kingdom are also restricted from accessing our Platform and Services (collectively referred to as “Minors”). Accessing or using the Platform by Minors constitutes a violation of our Terms of Service and Privacy Policy
We do not knowingly collect, solicit, or process any Personal Information from Minors. We implement commercially reasonable age verification measures and data protection practices to prevent such unauthorised collection and usage.
If you are a parent or legal guardian (“Guardian”) and believe your child has provided us with Personal Information, we urge you to promptly contact us at support@ctruh.com. Upon verification of your Guardian status, we will promptly take all necessary steps to remove and delete such information from our records.

14. HOW CAN YOU EXPRESS YOUR COMPLAINTS AND CONCERNS?

User satisfaction is one of the key focus areas and an integral part of our Platform's founding principles and business policies. We strongly believe that User satisfaction is the most important factor in the growth and development of our business, and hence, we have adopted user-centricity as a priority in developing our business processes. The terms below shall constitute our “User Grievance Redressal Policy”, which outlines the framework for addressing User grievances:
Objective: The objective of this Grievance Policy is to provide a framework:
to ensure the provision of timely and effective resolution of issues raised by the User; and
to keep the User informed about the manner in which they can reach out to us to resolve their queries and grievances.
Governing Principles: The policy on grievance redressal is governed by the following principles:
User shall be treated fairly at all times;
issues raised by Users are always attended to with courtesy and on time;
Users are provided with effective and satisfactory resolution within a reasonable time period; and
Users are fully informed of avenues to escalate their issues/grievances if they are not fully satisfied with the response to their complaints.
Grievance Redressal: Any User can reach out to our Grievance Redressal Officer through electronic mode by way of email communication at support@ctruh.com. Users can expect a reply within 7 days; and
Must Know: You must know and understand that:
We DO NOT solicit confidential details like your OTP/CVV/PIN/Card Number/Bank account details through any means.
Scamsters/fraudsters attempt various techniques such as ‘phishing’ to contact, influence, and defraud consumers. We regularly caution our Users against sharing any personal or payment-sensitive information with unknown persons, as such sharing leads to unauthorised use and/or fraud and consequent financial loss.
We shall not be liable for any loss, damage, or expense incurred by a User where the User has shared personal and/or payment-sensitive information with scamsters/fraudsters.
We also request and encourage our Users to report such attempts or incidents to us at support@ctruh.com to enable us to investigate and explore legal recourse.

15. HOW ARE CHANGES MADE TO THIS POLICY?

This Policy may be updated at our sole discretion or due to changes in the law. Such changes, unless otherwise stated, will be effective from the day and date of posting on the Platform. We reserve the right to update the Policy without obligation to notify Users. It is recommended to regularly review this Policy for any changes, as your continued access and use of the Platform will be considered your approval and acceptance of all modifications to this Policy. In cases where applicable law mandates, we may notify you of updates through email. If you do not agree with this Policy governing our Platform, please refrain from using the Platform or the Services provided by us.

16. HOW CAN YOU CONTACT US?

Should you need additional information or have any questions or complaints regarding the handling of your Personal Data, please reach out to us in writing at:

Email: support@ctruh.com

Schedule I — Indian Residents

We are committed to safeguarding the privacy rights of our Users in India. This schedule outlines our compliance with Indian privacy laws, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (IT Rules), and the Digital Personal Data Protection Act (DPDPA), 2023. These regulations ensure that Personal Data is processed fairly, lawfully, and transparently.

YOUR DATA SUBJECT RIGHTS:

Right to Consent: Your explicit consent is required for the collection and processing of your Sensitive Personal Data or Information (SPDI).
Right to Access: You have the right to access your Personal Data and obtain a copy of it.
Right to Correction: You can request corrections to any inaccurate or incomplete Personal Data.
Right to Withdrawal of Consent: You can withdraw your consent to the processing of your Personal Data at any time.
Right to Review Information: You can review the information you have provided and ensure it is accurate and up-to-date.
Right to Grievance Redressal: You have the right to lodge a complaint regarding the processing of your Personal Data with our Grievance Officer.

DATA RETENTION AND DE-IDENTIFICATION:

We are committed to retaining Personal Data only for as long as necessary to fulfil the purposes for which it was collected, as outlined in our main Privacy Policy. We may also take measures to de-identify Personal Data in accordance with applicable laws and regulations.

APPEAL PROCESS

If you disagree with the Firm's response to your privacy rights request or believe your rights have not been adequately addressed, you have the right to appeal. You can submit your appeal in writing to our Data Protection Officer with the subject line “Appeal of Privacy Rights Request.”

LODGING A COMPLAINT

If you believe your rights have been violated or are dissatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of India (DPIC). The DPIC is responsible for handling complaints related to data protection and ensuring compliance with the DPDPA.

ADDITIONAL INFORMATION:

For more detailed information on how we handle your Personal Data, including our data collection practices, security measures, and third-party disclosures, please refer to our main Privacy Policy available.

Schedule II — European Union Residents

We are committed to ensuring compliance with the European Union General Data Protection Regulation (GDPR).

Although our Privacy Policy explains how we meet all of our obligations for United Kingdom Users, we also have some Users who are habitually located in the European Union ('EU Residents') who have additional rights with respect to their Personal Data.

Personal Data is defined as: “Any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier”. The term “Personal Data” should be considered fundamentally interchangeable with the expression “Personal Information” for the purposes of this Privacy Policy.

Under the GDPR, we are the “Data Controller” and “Data Processor” of Personal Data. As part of our GDPR compliance, we provide and operate the App in a way that ensures: Personal Data (i.e. Personal Information) is processed fairly, lawfully, and in a transparent manner; and collected and processed only for specified and lawful purposes.

We ensure that the Personal Data we collect about you is accurate, complete, and used for its intended purpose. You may access, review, correct, and update your Information by contacting us by email at the contact details below.

EUROPEAN UNION RESIDENTS

In certain circumstances, you have certain rights regarding your Personal Information. A summary of each right and how you can exercise it is detailed below. To exercise any of these rights, please contact us at support@ctruh.com. Such requests should include information to allow us to verify your identity (e.g. your name, address, email address, or other information reasonably required).

Where we receive your request to exercise one of these rights, we will respond without undue delay and within the time required by applicable law. This may be extended in certain circumstances, e.g. where requests are complex or numerous.

We will provide the information free of charge, except where requests are manifestly unfounded or excessive, e.g. because of their repetitive character. In these circumstances, we may charge a reasonable fee or may refuse to act on the request. We will advise you of any fees prior to proceeding with a request. We may ask for additional information to verify your identity before carrying out a request.

HOW CAN YOU EXERCISE YOUR RIGHT?

Right to access and/or correct your Personal Data
You have the right to access the Personal Data we hold about you, and to be provided with a copy of the information (in most circumstances). You also have the right to correct any information we may hold about you that is inaccurate.
Right to restrict the use of your Personal Data
You have the right to ask us to restrict the processing of your Personal Data where one of the following applies:
The processing is unlawful, but you want us to restrict the use of the data instead of deleting it;
Where you contest the accuracy of your Personal Data, the restriction will apply until we have verified the accuracy or corrected your Personal Data;
We no longer require the Personal Data for the purposes of the processing, but are required to keep it in connection with a legal claim;
You have exercised your right to object to the processing. The restriction will apply until we have taken steps to verify whether we have compelling legitimate grounds to continue processing.
Right to withdraw consent and request deletion of your Personal Data
You have the right to ask us to delete your Personal Data in most circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the Personal Data is required to comply with a legal obligation or for the establishment, exercise, or defence of legal claims.
You may object to our use of your Personal Data for marketing purposes, and you can let us know via the provided email address.
Further, you may also object to the processing of your Personal Data in cases where we have used legitimate interests as the basis for processing. In such cases, we will stop processing your Personal Data until we verify that we have compelling legitimate grounds for processing that outweigh your interests, rights, and freedoms in asking us to stop processing the data, or in limited cases where we need to continue processing the data for the establishment, exercise, or defence of legal claims.
Data retention and anonymisation
We are committed to retaining Personal Information only for as long as necessary to fulfil the purposes for which it was collected, as outlined in our main Privacy Policy. We may also take measures to de-identify Personal Information in accordance with applicable laws and regulations.
Right to data portability
In most cases, you have the right to receive all Personal Data you have provided to us in a structured, commonly used, and machine-readable format and to transmit this data to another data controller, where technically feasible.
Right to lodge a complaint with a supervisory authority
If you are a resident of the EU, you have the right to make a complaint at any time to the regulator in your jurisdiction. To find out how to contact your local regulator, please visit https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We will allow and assist Users who are EU Residents to exercise these rights unless we have compelling and legitimate legal grounds not to (e.g. a legal obligation under United Kingdom legislation, or if the Personal Data has been fully anonymised).

Schedule III — United Kingdom (UK) Residents

We are dedicated to upholding the principles of the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

While our Privacy Policy outlines our commitments to European Union Users, we recognise that Users located in the United Kingdom ('UK Residents') have additional rights concerning their Personal Data.

YOUR DATA SUBJECT RIGHTS:

You have several rights under applicable Data Protection Laws in relation to your Personal Information. Under certain circumstances, you have the right to:

Have access to your Personal Information by submitting a request to us;
Have your Personal Information deleted;
Have your Personal Information corrected if it is wrong;
Have the processing of your Personal Information restricted;
Object to further processing of your Personal Information, including to object to marketing from us;
Make a data portability request;
Withdraw any consent you have provided to us;
Restrict any automatic processing of your Personal Information; and
Complaint to the appropriate supervisory authority.
To exercise any of these rights, please contact us at support@ctruh.com.

A. BASIS FOR PROCESSING:

We will only process your Personal Information when we have a lawful basis to do so, such as consent, contractual necessity, or legitimate interests. Also, please refer to our main Privacy Policy to understand how we process your Personal Information.

B. PROCESS OF APPEAL:

If you disagree with the Firm's response to your privacy rights request or believe your rights have not been adequately addressed, you have the right to appeal. You can submit your appeal in writing to our Data Protection Officer at support@ctruh.com with the subject line “Appeal of Privacy Rights Request”.

Schedule IV — United States Residents

We are dedicated to adhering to the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA) and other relevant state privacy regulations. If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nevada, Oregon, Texas, Utah, Vermont, Virginia, or Washington, or if you fall under the protections offered by privacy laws in those states, this section serves as an addition to our primary Privacy Policy , detailing your specific rights and protections.

According to the CCPA, “Personal Information” encompasses any data that can identify, relate to, describe, or be reasonably associated with a specific consumer or household. This includes a variety of information types such as names, addresses, and online identifiers, among others.

We make every effort to ensure that the Personal Information we gather is precise, relevant, and utilised correctly. You have the right to access, delete, and request disclosures regarding your Personal Information. For any questions or to exercise these rights, please reach out to us using the contact details provided below.

A. YOUR PRIVACY RIGHTS:

Right to access: You can access the information that has been provided by you by reaching out to us at support@ctruh.com.
Right to withdraw consent: The consent that you provide for the collection, use, and disclosure of your Personal Information will remain valid until such time it is withdrawn by you in writing. If you withdraw your consent, we will stop processing the relevant Personal Information except to the extent that we have other grounds for processing such Personal Information under applicable laws. We will respond to your request within a reasonable timeframe. You may withdraw your consent at any time by contacting us; and
Right to Opt-Out: You have the right to opt out of certain processing activities, such as the sale of Personal Information or the use of Personal Information for targeted advertising purposes. We will respect your preferences and refrain from such activities upon your request.
Right to correction: You are responsible for maintaining the accuracy of the information you submit to us, including but not limited to your Contact Information. For any necessary updates or corrections to your Personal Information, Users can easily modify details using the provided App functionalities or by reaching out to us at support@ctruh.com.
Right of Access and Portability: In some jurisdictions, applicable law may entitle you to request certain copies of your Personal Information or information about how we handle your Personal Information, request copies of Personal Information that you have provided to us in a structured, commonly used, and machine-readable format, and/or request that we transmit this information to another service provider, where technically feasible.
Right of Erasure: In some jurisdictions, you can request that your Personal Information be deleted.

B. DATA CONTROLLER AND PROCESSOR:

Under various U.S. privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) and other state-specific regulations, we act as the “Data Controller” as well as “Data Processor” of Personal Data. To ensure compliance, we operate our services in a manner that guarantees: Personal Data is processed fairly, lawfully, and transparently; and it is collected and used only for legitimate and specified purposes.

C. APPEAL PROCESS:

If you disagree with the Firm's response to your privacy rights request or believe your rights have not been adequately addressed, you have the right to appeal. You can submit your appeal in writing to our Data Protection Officer at support@ctruh.com with the subject line “Appeal of Privacy Rights Request”.

D. DATA RETENTION AND DE-IDENTIFICATION:

We are committed to retaining Personal Information only for as long as necessary to fulfil the purposes for which it was collected, as outlined in our main Privacy Policy. We may also take measures to de-identify Personal Information in accordance with applicable laws and regulations.

E. LODGING A COMPLAINT

If you believe your rights have been violated or are dissatisfied with our response, you have the right to lodge a complaint with the federal agencies such as the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB). You may also contact the State Attorney General's Office of your residential state. These organisations are responsible for handling complaints related to data protection and ensuring compliance with the privacy laws.

F. ADDITIONAL INFORMATION:

For more detailed information on how we handle your Personal Information, including our data collection practices, security measures, and third-party disclosures, please refer to our main Privacy Policy available.

Ready to bring your product to life?

Ready to bring your product to life?