PRIVACY POLICY

Bracket India Private Limited

Last Updated: 30 April 2026

Effective Date: 30 April 2026

1. INTRODUCTION

This Privacy Policy (“Policy”) is published in compliance with the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and all other applicable laws and regulations of India relating to the processing of personal data.

This Policy describes how Bracket India Private Limited (“Bracket,” “Company,” “we,” “us,” or “our”), a company incorporated under the laws of India, having its registered office at NO 293, SF Western Marg, Saidulajab, Gadaipur, South West Delhi, New Delhi – 110030, collects, uses, stores, discloses, and otherwise processes personal data of users (“you,” “your,” or “User”) who access or use our mobile applications available on Google Play Store and Apple App Store, our website, and any related services (collectively, the “Platform”).

By accessing or using the Platform, you confirm that you have read, understood, and agree to be bound by this Policy. If you do not agree with any part of this Policy, please do not access or use the Platform. Your continued use of the Platform following the posting of any changes to this Policy constitutes your acceptance of those changes.

2. ABOUT THE PLATFORM

Bracket is a social commerce platform that enables Users to discover and shop fashion products directly from video content. Users can watch videos posted by brands, creators, and other Users and seamlessly shop the products featured in those videos through integrated links and product listings. The Platform facilitates the discovery, curation, and purchase of fashion products through an engaging, video-first shopping experience.

3. ELIGIBILITY

The Platform is intended solely for individuals who are 18 (eighteen) years of age or older. We do not knowingly collect, process, or store personal data of individuals below the age of 18 (eighteen) years. If we become aware that we have inadvertently collected personal data from a minor, we will take reasonable steps to delete such data from our records promptly. If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at the details provided in Section 15 of this Policy, and we will take steps to remove such information.

4. PERSONAL DATA WE COLLECT

We collect and process the following categories of personal data when you access, register on, or use the Platform.

4.1 Information You Provide Directly

When you create an account, update your profile, or interact with the Platform, you may provide us with the following information: (a) your full name; (b) your email address; (c) your gender; (d) your age; (e) your date of birth; (f) your profile photograph; and (g) any other information you voluntarily provide while using the Platform, including but not limited to reviews, comments, wishlists, and other user-generated content.

4.2 Information Collected Through Third-Party Sign-In

When you choose to register or log in using third-party authentication services such as Google Sign-In or Apple Sign-In, we may receive certain information from your third-party account, including your name, email address, and profile picture, in accordance with the permissions you grant and the privacy settings of your third-party account. We encourage you to review the privacy policies of Google and Apple to understand how they handle your data.

4.3 Information Collected Automatically

When you access or use the Platform, we may automatically collect certain technical and usage information, including but not limited to: (a) your Internet Protocol (IP) address; (b) your device type, operating system, and browser type; (c) unique device identifiers; (d) information about whether you are a new or returning visitor; (e) pages or screens viewed, time spent on pages or screens, and navigation paths; (f) app crash reports and performance data; (g) date and time of access; and (h) referral URLs or sources through which you accessed the Platform.

4.4 Cookies and Similar Tracking Technologies

We use cookies, pixels, software development kits (SDKs), and similar tracking technologies to recognise returning Users, enhance User experience, analyse Platform usage, and deliver relevant content. These technologies may collect information about your browsing behaviour, preferences, and interactions with the Platform. You may manage your cookie preferences through your browser or device settings; however, disabling cookies may affect the functionality of the Platform. For more information, please refer to Section 10 of this Policy.

4.5 Information from Contacts (Optional)

If you choose to use our referral or invite feature, you may grant the Platform access to your device’s contact list. This access is entirely optional and will only be initiated with your explicit consent. We will use this information solely to facilitate the referral or invitation and will not store your contacts’ information beyond what is necessary to complete the referral process.

4.6 User-Generated Content

The Platform may allow you to post reviews, comments, create wishlists, and share other content. Please note that any content you post or share on the Platform may be visible to other Users. You should exercise caution before disclosing any personal data in user-generated content, as such information may become publicly available.

5. PURPOSE OF COLLECTION AND USE OF PERSONAL DATA

We collect and use your personal data for the following purposes: (a) to create, maintain, and manage your account on the Platform; (b) to verify your identity and authenticate your access to the Platform; (c) to personalise your experience on the Platform, including curating video content and product recommendations based on your preferences, browsing behaviour, and interactions; (d) to facilitate the discovery and purchase of fashion products through the Platform; (e) to enable you to post reviews, comments, create wishlists, and engage with other features of the Platform; (f) to communicate with you, including sending service-related announcements, updates, and administrative messages; (g) to send you promotional and marketing communications, including push notifications, emails, and SMS messages, subject to your preferences and applicable law; (h) to analyse usage trends, monitor Platform performance, and improve the functionality, content, and design of the Platform; (i) to detect, prevent, and address fraud, security breaches, and other potentially prohibited or illegal activities; (j) to enforce our Terms of Use and other agreements; (k) to comply with applicable laws, regulations, legal processes, and governmental requests; (l) to facilitate referral and invite features where you voluntarily share the Platform with your contacts; and (m) for any other purpose with your consent or as otherwise permitted under applicable law.

6. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases under the DPDP Act, 2023 and other applicable Indian laws: (a) your consent, which you provide at the time of registering on the Platform or when you voluntarily provide information to us; (b) the performance of a contract, where processing is necessary to provide you with the services offered through the Platform; (c) compliance with legal obligations, where we are required to process your data to comply with applicable laws and regulations; and (d) legitimate uses as permitted under the DPDP Act, 2023, including processing necessary for our legitimate business interests, provided that such interests are not overridden by your rights and interests.

You may withdraw your consent at any time by contacting us at the details provided in Section 15 of this Policy. Please note that withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal and may result in the termination of your access to certain features of the Platform.

7. DISCLOSURE AND SHARING OF PERSONAL DATA

We do not sell, rent, or trade your personal data to any third party. However, we may share your personal data in the following circumstances.

7.1 Service Providers and Business Partners

We may share your personal data with third-party service providers, vendors, and business partners who assist us in operating the Platform, conducting our business, or providing services to you, including but not limited to: (a) cloud hosting and data storage providers (such as Amazon Web Services); (b) analytics and performance monitoring providers (such as Google Analytics, Firebase, and similar tools); (c) advertising and marketing platforms (such as Meta, Google Ads, and similar services); (d) customer support service providers; and (e) communication service providers for sending emails, push notifications, and SMS messages. These third parties are contractually obligated to use your personal data only for the purposes for which it is shared and in accordance with this Policy and applicable law.

7.2 Brands and Partners

As of the date of this Policy, we do not share your personal data with the brands whose products are featured on the Platform. However, we reserve the right to share certain personal data with brand partners and affiliate platforms in the future to enhance your shopping experience, provide personalised product recommendations, and facilitate transactions. Any such sharing will be carried out in compliance with applicable law, and this Policy will be updated to reflect the same. We will notify you of any material changes to our data-sharing practices in accordance with Section 14 of this Policy.

7.3 Legal and Regulatory Requirements

We may disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or where we believe in good faith that such disclosure is necessary to: (a) comply with applicable Indian laws, rules, or regulations, including the IT Act, SPDI Rules, DPDP Act, and any orders of courts or tribunals; (b) enforce our Terms of Use or other agreements; (c) protect and defend the rights, property, or safety of the Company, our Users, or others; or (d) detect, prevent, or otherwise address fraud, security, or technical issues.

7.4 Business Transfers

In the event of a merger, acquisition, reorganisation, restructuring, dissolution, sale of assets, or similar corporate transaction, your personal data may be transferred as part of the transaction. We will provide notice of any such transfer and any choices you may have regarding your personal data.

7.5 With Your Consent

We may share your personal data with third parties where you have provided your express consent for such sharing.

8. DATA STORAGE AND SECURITY

8.1 Data Storage

Your personal data is stored on servers provided by Amazon Web Services (AWS) located in India. We ensure that appropriate contractual and technical safeguards are in place with our hosting provider to protect your personal data.

8.2 Security Measures

We implement reasonable security practices and procedures, as required under the SPDI Rules and the DPDP Act, 2023, to protect your personal data from unauthorised access, use, disclosure, alteration, or destruction. These measures include, but are not limited to: (a) encryption of data in transit and at rest; (b) access controls and authentication mechanisms to restrict access to personal data to authorised personnel only; (c) regular security assessments and audits; (d) secure development practices for the Platform; and (e) employee training and awareness programmes regarding data protection.

Notwithstanding the above, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

9. DATA RETENTION

We retain your personal data for as long as your account remains active on the Platform and for such additional period as may be necessary to fulfil the purposes outlined in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Upon deletion of your account or upon your request for erasure of personal data, we will delete or anonymise your personal data within a reasonable time, except to the extent that retention is required or permitted under applicable Indian laws, including for the establishment, exercise, or defence of legal claims. Anonymised or aggregated data that does not identify you may be retained indefinitely for analytical and business purposes.

10. COOKIES AND TRACKING TECHNOLOGIES

The Platform uses cookies and similar tracking technologies, including SDKs, pixels, and local storage, to collect information about your usage of the Platform. The types of cookies and tracking technologies we use include: (a) strictly necessary cookies, which are essential for the operation of the Platform and enable core functionalities such as authentication and security; (b) analytics and performance cookies, which help us understand how Users interact with the Platform, identify usage trends, and improve Platform performance; (c) functionality cookies, which remember your preferences and settings to enhance your experience; and (d) advertising and targeting cookies, which are used to deliver relevant advertisements and measure the effectiveness of our marketing campaigns.

You can manage your cookie preferences through your browser or device settings. Please note that disabling certain cookies may limit your ability to use some features of the Platform. Third-party analytics and advertising partners may also use their own cookies and tracking technologies, which are subject to their respective privacy policies.

11. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, applications, or services, including the websites and applications of brands whose products are featured on the Platform. These third-party services are not operated or controlled by us, and this Policy does not apply to them. We are not responsible for the privacy practices, content, or security of any third-party services. We encourage you to review the privacy policies of any third-party services before providing them with your personal data. Any transactions you enter into with third-party sellers or brands are solely between you and such third parties, and we shall not be liable for any loss or damage arising from such transactions.

12. YOUR RIGHTS

Under the DPDP Act, 2023, and other applicable Indian laws, you have the following rights in relation to your personal data: (a) the right to access and obtain confirmation as to whether your personal data is being processed, and to receive a summary of such data; (b) the right to correction and erasure, allowing you to request the correction of inaccurate or incomplete personal data and the erasure of personal data that is no longer necessary for the purposes for which it was collected; (c) the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal; (d) the right to nominate another individual to exercise your rights in the event of your death or incapacity, as provided under the DPDP Act, 2023; and (e) the right to grievance redressal, allowing you to file a complaint with the Grievance Officer designated under this Policy or with the Data Protection Board of India.

To exercise any of the above rights, please contact us at the details provided in Section 15 of this Policy. We will respond to your request within a reasonable time during the Indian business hours and in accordance with applicable Indian laws. We may require you to verify your identity before processing your request.

13. MARKETING COMMUNICATIONS

We may send you promotional and marketing communications, including emails, SMS messages, and push notifications, about new features, products, offers, and events related to the Platform. You may opt out of receiving marketing communications at any time by: (a) clicking the “unsubscribe” link included in our marketing emails; (b) adjusting your notification preferences within the Platform settings; (c) disabling push notifications through your device settings; or (d) contacting us at the details provided in Section 15 of this Policy. Please note that even if you opt out of marketing communications, we may continue to send you service-related and transactional communications that are necessary for the operation of your account.

14. CHANGES TO THIS POLICY

We reserve the right to update, modify, or revise this Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Any changes to this Policy will be effective upon posting of the revised Policy on the Platform, with the “Last Updated” date revised accordingly. Where required by applicable law, including the DPDP Act, 2023, we will notify you of material changes through the Platform, via email, or through other appropriate communication channels before such changes take effect. Your continued use of the Platform after the posting or notification of any changes to this Policy constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

15. CONTACT US

If you have any questions, concerns, or requests regarding this Policy or our data practices, please contact us at:

Bracket India Private Limited NO 293, SF Western Marg, Saidulajab, Gadaipur, South West Delhi, New Delhi-110030 Email: bracketindia.team@gmail.com

16. GRIEVANCE OFFICER

In accordance with the Information Technology Act, 2000, the SPDI Rules, 2011, and the DPDP Act, 2023, the details of the Grievance Officer appointed by the Company are set out below:

Name: Shivani Goyal Designation: Legal & Compliance Email: bracketindia.team@gmail.com Address: NO 293, SF Western Marg, Saidulajab, Gadaipur, South West Delhi, New Delhi – 110030

If you are not satisfied with the resolution provided by the Grievance Officer, you may file a complaint with the Data Protection Board of India established under the DPDP Act, 2023, in accordance with the procedures prescribed thereunder.

17. GOVERNING LAW AND JURISDICTION

This Policy shall be governed by and construed in accordance with the laws of Republic of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts located in New Delhi, India.

This Policy was last reviewed and updated on 30 April 2026.