PRIVACY POLICY

LAST UPDATED: 12 September 2026

This Privacy Policy ("Policy") describes how EKLY AI PRIVATE LIMITED ("Ekly AI", "Company", "we", "our" or "us") collects, receives, uses, processes, stores, transfers, shares, discloses, retains and otherwise handles Personal Data relating to individuals who access or use our website, web applications, APIs, software, artificial intelligence tools, enterprise offerings and related products and services (collectively, the "Services").

This Policy applies to website visitors, account holders, subscribers, customers, enterprise clients, API users, business representatives and other individuals who interact with Ekly AI through the Services, website, applications, communications, customer support or other authorised channels.

Ekly AI operates an AI-powered SaaS platform that enables users to create, generate, edit, enhance, process and manage digital content, including videos, images, voiceovers, subtitles, captions, scripts, translations, animations, avatars, audio, graphics and other multimedia content using artificial intelligence and related technologies.

This Policy is intended to be read together with the Terms of Use, the End Users Agreement, and any applicable service-specific or enterprise agreements. In the event of any inconsistency concerning the processing of Personal Data, the applicable data processing terms contained in an executed enterprise agreement, data processing agreement or other specific written agreement shall prevail to the extent of such inconsistency.

This Policy is framed with reference to the Digital Personal Data Protection Act, 2023, applicable rules, regulations and notifications issued thereunder, the Information Technology Act, 2000, other applicable Indian data protection and privacy laws, and the General Data Protection Regulation (EU) 2016/679 ("GDPR"), where applicable to the processing undertaken by Ekly AI.

Registered Office: No. 472/7, Balaji Arcade, AVS Compound, 20th L Cross Road, AVS Layout, Ejipura, Koramangala, Bengaluru – 560095, India

Where Ekly AI determines the purposes and means of processing Personal Data for its own business and provision of the Services, it acts as a Data Fiduciary under applicable Indian data protection law and as a controller under the GDPR, where applicable.

Where Ekly AI processes Personal Data on behalf of an enterprise customer, the enterprise customer may act as the Data Fiduciary or controller, as applicable, and Ekly AI may act as a data processor or processor. In such circumstances, Ekly AI will process such Personal Data in accordance with the applicable agreement, documented instructions and applicable law. The rights and obligations of the parties in relation to such processing may also be governed by the applicable enterprise agreement and/or data processing agreement.

This Policy may be updated from time to time to reflect changes in the Services, our processing practices, applicable law or regulatory requirements. The revised version will be published through the Services with an updated "Last Updated" date.

1. PERSONAL DATA WE COLLECT

Depending on how you use the Services, Ekly AI may collect and process the following categories of Personal Data:

(a) Account Information

This may include your name, email address, mobile number, login credentials, account identifiers, profile information and other information required to create, authenticate and administer your account.

(b) Subscription and Payment Information

Where you purchase or subscribe to paid Services, we may process information relating to your subscription, billing details, transaction records, invoices, payment status and related information.

Payment card and other payment credentials may be processed directly by authorised payment service providers. Ekly AI does not ordinarily store complete payment card details.

(c) User Content

The Services may allow you to upload, submit, create, store or otherwise provide content and materials, including prompts, documents, images, videos, audio files, PDFs, brand assets, logos, fonts, templates, project files and other materials ("User Content").

User Content may contain Personal Data relating to you or other individuals. You are responsible for ensuring that you have the necessary rights, permissions, consents or other lawful authority to provide such content to Ekly AI and use it through the Services.

(d) AI-Generated Content

We may process and retain outputs generated through the Services, including generated text, images, videos, audio, voiceovers, scripts, graphics, animations, avatars, subtitles, captions and other multimedia outputs.

AI-generated outputs are probabilistic and may vary based on prompts, inputs, settings, models, technical conditions and other factors.

(e) Technical and Usage Information

We may collect information relating to your device, browser, operating system, IP address, approximate location derived from technical information, device identifiers, access times, session information, usage patterns, interaction with the Services, error logs, diagnostic information and other technical information generated through use of the Services.

(f) Cookies and Similar Technologies

We may use cookies, pixels, software development kits, local storage and similar technologies to operate, secure, analyse and improve the Services.

Where required by applicable law, we will obtain consent before using non-essential cookies or similar technologies. Where applicable, you may withdraw or modify your consent through available cookie or privacy settings. Browser and device settings may also affect the functionality of certain features.

(g) Customer Support Information

If you contact us for support, we may collect your contact information, communications, support requests, feedback, attachments, records of interactions and other information necessary to investigate and resolve your request.

(h) Enterprise Information

Where you access the Services through an enterprise or business customer, we may process business contact information, account information, workspace information, user identifiers, administrative information and other information necessary to provide and administer the applicable enterprise Services.

Where Ekly AI processes Personal Data on behalf of an enterprise customer, such processing will be governed by the applicable enterprise agreement and/or data processing agreement, as applicable.

(i) Information Received from Third Parties

We may receive information from third-party service providers, integration partners, enterprise customers, authentication providers, payment providers, analytics providers or other parties where such information is lawfully provided to us.

(j) Information Generated Through Use of the Services

We may generate or derive information from your use of the Services, including project activity, generation requests, editing history, workspace activity, service preferences, support interactions, usage analytics, security information and other information reasonably necessary to operate, secure and improve the Services.

2. HOW WE COLLECT PERSONAL DATA

We may collect Personal Data through the following methods:

(a) Directly from You

We collect information that you voluntarily provide when creating an account, subscribing to the Services, uploading User Content, using AI features, contacting support, communicating with us or otherwise interacting with the Services.

(b) Automatically

We may automatically collect technical and usage information through cookies, SDKs, pixels, local storage, logs and similar technologies when you access or use the Services. Where required by applicable law, consent will be obtained for non-essential tracking technologies.

(c) From Third Parties

We may receive information from third-party service providers, enterprise customers, integration partners, payment providers, authentication providers and other authorised sources.

(d) Through Your Use of the Services

Certain information is generated through your use of the Services, including prompts, uploads, generation requests, outputs, editing history, workspace activities, service interactions, support communications and technical or usage information.

3. HOW WE USE PERSONAL DATA

We may use Personal Data for the following purposes:

(a) Providing and Managing the Services

To create and administer accounts, authenticate users, provide requested features, process transactions, operate workspaces, provide customer support and otherwise provide the Services.

(b) Processing User Content and AI Requests

To process prompts, uploads, instructions and other inputs and to generate, edit, transform, enhance or otherwise process content through the AI-powered features of the Services.

(c) Customer Support

To respond to enquiries, provide technical assistance, investigate issues and communicate with you regarding the Services.

(d) Maintaining and Improving the Services

To monitor performance, identify technical issues, conduct analytics, improve functionality, develop features and maintain the reliability and security of the Services.

(e) Protecting the Services

To detect, prevent and investigate fraud, abuse, security incidents, unauthorised access, misuse, violations of our Terms of Use or End Users Agreement and other activities that may adversely affect the Services, users or the Company.

(f) Marketing Communications

To send communications regarding Ekly AI's products, Services, features, updates, offers and other information relating to Ekly AI, subject to applicable law and consent requirements.

Where required by law, marketing communications will be sent only with the necessary consent. You may opt out of promotional communications in accordance with the applicable communication or account settings.

(g) Legal and Contractual Compliance

To comply with applicable legal, regulatory, tax, accounting and contractual obligations, respond to lawful requests and enforce our contractual rights.

(h) Business Administration and Legitimate Interests

Where permitted by applicable law, to administer our business, maintain records, manage risks, protect our rights and interests, improve our Services and conduct other legitimate business activities.

(i) Other Lawful Purposes

For other purposes permitted or required by applicable law.

3.1 Consent

Where processing is based on consent, Ekly AI will obtain consent in accordance with applicable law.

You may withdraw consent where permitted by law. Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal.

Withdrawal of consent may affect our ability to provide certain Services or features where the relevant processing is necessary for those Services.

3.2 GDPR Lawful Bases

Where the GDPR applies, Ekly AI may process Personal Data on one or more lawful bases, including:

•  performance of a contract;
•  compliance with a legal obligation;
•  legitimate interests, where such interests are not overridden by applicable rights and interests; and
•  consent, where required or relied upon.

The applicable lawful basis may depend on the nature and purpose of the processing.

3.3 AI-Assisted Processing

The Services use artificial intelligence, machine learning, automation and related technologies, including proprietary and third-party AI models, APIs, cloud infrastructure and supporting technologies.

Ekly AI may process prompts, uploads, instructions, User Content, generated outputs and related information through such technologies to provide, maintain, secure, support and improve the Services, subject to applicable contractual, technical and organisational safeguards.

Third-party AI, cloud, infrastructure and technology providers may process information on Ekly AI's behalf where necessary to provide the Services, subject to applicable contractual and data protection obligations.

The Services are not intended, by themselves, to make decisions producing legal or similarly significant effects concerning individuals solely through automated processing. Users remain responsible for reviewing and validating AI-generated outputs before relying on them.

Ekly AI may use automated technologies for purposes such as analysing usage, detecting abuse, monitoring performance, improving user experience, maintaining service functionality and securing the Services.

4. YOUR DATA PROTECTION RIGHTS

Subject to applicable law, you may have rights in relation to your Personal Data, including:

(a) Access

To request access to Personal Data processed by Ekly AI about you.

(b) Correction, Updating and Erasure

To request correction or updating of inaccurate or incomplete Personal Data and, where applicable, deletion or erasure of Personal Data.

(c) Withdrawal of Consent

To withdraw consent where processing is based on consent and applicable law permits such withdrawal.

(d) Grievance

To raise a grievance or complaint concerning the processing of your Personal Data.

(e) Nomination

Where provided by applicable law, to nominate another individual to exercise specified rights in accordance with the applicable legal requirements.

Requests may be submitted using the privacy contact details specified in Section 9 of this Policy.

4.1 Additional GDPR Rights

Where the GDPR applies, you may also have the right, subject to applicable conditions and exemptions, to:

•  request access to your Personal Data;
•  request rectification of inaccurate or incomplete Personal Data;
•  request erasure of Personal Data;
•  request restriction of processing;
•  object to certain processing;
•  request data portability;
•  withdraw consent where processing is based on consent; and
•  lodge a complaint with the competent supervisory authority.

5. SECURITY AND DATA RETENTION

(a) Security

Ekly AI implements reasonable technical, organisational and administrative safeguards designed to protect Personal Data against unauthorised access, alteration, disclosure, loss, misuse or destruction.

Depending on the nature and sensitivity of the information and the risks involved, such measures may include encryption, access controls, authentication mechanisms, monitoring, firewalls, audit logs, vulnerability management, backups and secure infrastructure.

No method of transmission, storage or processing can be guaranteed to be completely secure, and Ekly AI does not warrant absolute security of Personal Data.

(b) Retention

Ekly AI retains Personal Data for as long as reasonably necessary to provide and secure the Services, fulfil the purposes described in this Policy, comply with applicable legal, regulatory, tax, contractual and accounting requirements, maintain business and security records, resolve disputes, enforce agreements and protect its rights and interests.

Where Personal Data is no longer required for the applicable purposes or is otherwise required to be deleted under applicable law, Ekly AI will take reasonable steps to delete, anonymise, archive or securely dispose of such information, subject to lawful retention requirements.

6. SHARING AND DISCLOSURE OF PERSONAL DATA

Ekly AI may share or disclose Personal Data in the following circumstances:

(a) Service Providers

With third-party service providers that support our operations and Services, including payment processors, hosting and cloud providers, AI and machine learning providers, analytics and monitoring providers, communication and customer support providers, security providers, IT service providers, professional advisers, auditors and consultants.

Such parties will receive only the information reasonably necessary for the relevant purpose and will be subject to applicable contractual, confidentiality and data protection obligations.

(b) Enterprise Customers and Integration Partners

Where necessary to provide enterprise Services, integrations, transactions, workspace functionality or other features requested or authorised by the applicable customer or user, we may share relevant Personal Data with enterprise customers or integration partners.

Where an enterprise customer determines the purposes and means of processing and Ekly AI processes Personal Data on its behalf, the applicable enterprise customer will remain responsible for its processing as Data Fiduciary or controller, as applicable, and Ekly AI will process the relevant Personal Data in accordance with the applicable agreement, documented instructions and applicable law.

(c) Legal and Regulatory Requirements

Where required or permitted by applicable law, regulation, legal process, court order, governmental request or lawful direction, or where necessary to protect the rights, safety, property or security of Ekly AI, users or other persons.

(d) Business Transfers

In connection with an actual or proposed merger, acquisition, financing, restructuring, sale of assets, business transfer or similar transaction, subject to applicable law and appropriate confidentiality and data protection safeguards.

(e) User Content

Ekly AI does not sell, rent or trade User Content for monetary consideration.

User Content may be accessed, processed, stored or disclosed only to the extent reasonably necessary to provide, maintain, secure, support or improve the Services, comply with applicable law, enforce applicable agreements, or as otherwise disclosed to or authorised by the user.

7. CROSS-BORDER DATA TRANSFERS

Ekly AI may use service providers and infrastructure located outside India. Accordingly, Personal Data may be processed or stored outside India through cloud infrastructure, AI providers, payment providers, analytics providers or other technology and service providers.

Where the GDPR applies, Ekly AI will implement an applicable lawful mechanism for international transfers, which may include an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism recognised under applicable law.

For processing subject to Indian data protection law, cross-border transfers will be undertaken in accordance with the applicable provisions, rules, notifications, restrictions and directions under the Digital Personal Data Protection Act, 2023 and applicable subordinate legislation, as and when applicable.

8. THIRD-PARTY WEBSITES, APPLICATIONS AND SERVICES

The Services may contain links to, integrations with or functionality provided through third-party websites, applications, platforms, APIs or services.

Third-party services may have their own privacy policies, terms and data processing practices. Ekly AI is not responsible for the privacy practices of third parties that operate independently from Ekly AI.

You should review the applicable privacy policies and terms of third-party services before providing Personal Data to them or using their services.

9. PRIVACY CONTACT AND GRIEVANCE

In accordance with applicable law, Ekly AI has designated a contact to receive and address privacy-related requests, questions and grievances relating to the processing of Personal Data.

Name: Aksht Jain Designation: Grievance Officer / Data Protection Contact Address: No. 472/7, Balaji Arcade, AVS Compound, 20th L Cross Road, AVS Layout, Ejipura, Koramangala, Bengaluru – 560095, India Email: hello@ekly.ai Phone: +91 82969 99680

You may contact us regarding:

•  requests to exercise applicable data protection rights;
•  withdrawal of consent;
•  correction or deletion requests;
•  privacy-related complaints or grievances; and
•  questions concerning the processing of Personal Data.

Requests will be reviewed and addressed in accordance with applicable law and within applicable statutory timelines.

Where the GDPR applies, you may also lodge a complaint with the relevant competent data protection supervisory authority.

10. UPDATES TO THIS POLICY

Ekly AI may amend this Policy from time to time to reflect changes in the Services, business practices, technology, applicable law, regulatory requirements or security practices.

Where required by applicable law, we will provide appropriate notice of material changes.

The revised Policy will be published through the applicable Services and will state the revised "Last Updated" date.

11. GOVERNING LAW AND JURISDICTION

This Policy shall be governed by and construed in accordance with the laws of India.

Subject to applicable mandatory statutory or regulatory rights and requirements, the courts at Bengaluru, Karnataka, India shall have jurisdiction in relation to matters arising from or relating to this Policy.

Nothing in this Section limits any mandatory rights or remedies available under applicable data protection or privacy laws.