PRIVACY POLICY

GRIYON MOBILE APPLICATION

Effective Date: 11 October 2026 | Last Updated: 23 October 2026

1. Introduction

This Privacy Policy (hereinafter referred to as the “Policy”) describes how Griyon Private Limited (hereinafter referred to as “Griyon” / “Company” / “we” / “us” / “our”), the owner and operator of the Griyon mobile application and any associated websites (hereinafter referred to collectively as the “App” or “Platform”), collects, uses, discloses, stores, transfers and protects personal information of individuals who access or use the App, including individual users, business users, and visitors (hereinafter referred to as “you” / “User” or “Data Principal”).

This Policy has been prepared having regard to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent applicable and in accordance with their respective dates of commencement. As the provisions of the DPDP Act and Rules are subject to phased commencement, certain provisions referred to in this Policy may apply to Griyon only from the date on which the relevant statutory provisions become operative. The applicable requirements of the Google Play Developer Program Policies and Apple App Store Review Guidelines, to the extent relevant to the App’s distribution is complied with.

By downloading, installing, registering for, or otherwise using the App, you agree to the collection, use and disclosure of your information as described in this Policy. If you do not agree with this Policy, please do not use the App.

2. Scope and Application

This Policy applies to all personal information collected by Griyon through the App, including information provided by (a) individual users creating personal profiles, and (b) business users creating and operating business profiles on the Platform. It applies regardless of the device or platform (Android/iOS) used to access the App.

This Policy does not apply to third-party websites, applications or services that may be linked from within the App; such third parties are governed by their own privacy policies, and Griyon is not responsible for their practices.

3. Definitions

4. Categories of Personal Information We Collect

4.1 Individual Profile Information

When you create or maintain an individual profile on the App, we collect:

Griyon does not ask for or collect your Aadhaar number or any other government identity number through the App.

4.2 Business Profile Information

When a User creates or manages a business profile, we additionally collect:

4.3 Information Collected via Device Permissions

Subject to your explicit, informed and revocable consent (via your device’s operating-system permission controls), the App may request access only to the following:

The App does not request access to your contacts, SMS messages, call logs, phone state or background location. One-time passwords (OTPs) are entered by you; the App does not read your SMS messages. Notifications are currently shown within the App; if we introduce push notifications, your device will ask for your permission first and you can turn them off at any time.

4.4 Information Collected Automatically

4.5 Loan Enquiry Information

Griyon is not a lender; the “Loans” feature only passes your enquiry to Lending Partners (see Section 7). When you submit a loan enquiry, we collect:

The App does not collect identity documents, PAN, bank statements or income documents for loan enquiries. Any such documents are collected directly by the Lending Partner or the lender under its own privacy policy.

5. Purpose of Collection and Legal Basis for Processing

Griyon collects and processes your personal information to create and manage your account and profile, provide business listings and marketplace features, verify your identity and phone number, enable location-based discovery and in-app communication, pass your loan enquiries to Lending Partners when you ask us to, send transactional and, where you have opted in, promotional notifications, prevent and investigate fraud, misuse and violations of the Terms & Conditions, comply with applicable laws and lawful requests, and analyse and improve the performance, security and functionality of the App. Where the Digital Personal Data Protection Act, 2023 applies, Griyon processes personal data based on your free, specific, informed, unconditional and unambiguous consent given through clear affirmative action or, where applicable, on the basis of a “certain legitimate use” recognised under Section 7 of the DPDP Act 2023.

6. How We Use Your Information

Griyon may use your personal information to personalise your experience and the content available on the App, communicate with you regarding your account, transactions and support requests, conduct internal research and analytics to improve the App and its features, enforce our Terms & Conditions and Community Guidelines, and protect the rights, property, security and safety of Griyon, its Users and the public.

If you submit a loan enquiry, Griyon uses the information described in Section 4.5 only to pass your enquiry to Lending Partners, to show you the status of your enquiry in the App, and to handle any call-back request or complaint about it. Griyon does not use your loan enquiry information for advertising or to build a profile of you.

Any sharing or processing of personal information by Griyon shall be undertaken in accordance with the Terms & Conditions, this Privacy Policy and applicable data-protection and privacy laws.

7. Data Sharing and Disclosure

Griyon may share your personal information with other Users where such information, including your name, profile photo, business profile details or listings, is made visible as part of the App’s marketplace and social-networking features, subject to the privacy controls available on the App.

Griyon may also share or transmit limited personal information with third-party service providers engaged by Griyon for purposes necessary to operate, maintain, secure and improve the App, including cloud hosting providers, SMS/OTP service providers, analytics and crash-reporting providers, customer support service providers and, where applicable, payment processors, payment gateways and other service providers involved in facilitating transactions or providing services through the App. Any such information shall be transmitted through secure and encrypted channels and using reasonable technical and organisational security measures appropriate to the nature of the information being transmitted. Such third parties shall be required to maintain appropriate confidentiality and security safeguards and shall process the information only for the authorised purposes for which it has been shared and in accordance with applicable law.

Where payment gateways, banks or other financial or transaction service providers are used, certain information may be shared with or transmitted to such providers to the extent necessary to process, authenticate, verify or complete the relevant payment or transaction. Such transmission shall be carried out through secure channels and in accordance with applicable security standards and legal requirements.

Lending Partners. Only when you submit a loan enquiry and give your consent in the App, Griyon shares the information described in Section 4.5 with one or more Lending Partners, so that they can contact you about the loan you asked about. Each Lending Partner processes this information under its own privacy policy and applicable law, including the directions of the Reserve Bank of India. You can withdraw your consent for future sharing at any time by contacting the Grievance Officer; withdrawal does not affect information already shared with a Lending Partner, which you may ask that Lending Partner to delete.

Griyon may disclose personal information where required by applicable law, court order, regulatory requirement or lawful request of a government or law-enforcement authority, or where reasonably necessary to protect the rights, property, security or safety of Griyon, its Users or others.

In the event of a merger, acquisition, restructuring, sale of assets or similar business transaction, your personal information may be transferred as part of the transaction, subject to appropriate safeguards.

Griyon may also share your personal information with other third parties where you have provided specific consent.

Griyon does not sell your personal information to third parties for their independent marketing purposes.

8. Data Retention

Griyon retains your personal information only for as long as reasonably necessary to provide and improve the App’s services, fulfil the purposes for which the information was collected, comply with applicable legal, accounting or regulatory requirements, resolve disputes, and enforce its agreements and policies. The specific retention period may vary depending on the type of information and the purpose for which it is processed. When you delete your account, Griyon will delete or anonymise your personal information as described in Section 12, except where certain information is required to be retained under applicable law or is reasonably necessary for legal, security, fraud-prevention, dispute-resolution or other legitimate purposes.

9. Data Security

Griyon implements appropriate administrative, technical and organisational security measures designed to protect your personal information against unauthorised access, use, alteration, disclosure, loss, misuse or destruction, taking into account the nature and sensitivity of the information and applicable legal requirements. These measures may include encryption of personal information during transmission and storage, secure authentication mechanisms, access controls based on a need-to-know basis, restricted access to authorised personnel and service providers, secure storage practices, monitoring and periodic security reviews, and other reasonable safeguards appropriate to the risks involved. While Griyon takes reasonable measures to protect your personal information, no method of transmission, storage or electronic processing can be guaranteed to be completely secure, and Griyon therefore cannot guarantee absolute security of information transmitted to, stored on, or processed through the App.

10. Personal Data Breach Notification

In the event of a personal data breach, Griyon will take prompt and appropriate measures to contain, investigate and mitigate the breach and, where required under applicable law, notify the relevant regulatory authority, including the Data Protection Board of India, and affected Data Principals within the prescribed time and in the manner required by law. Where applicable, such notification will include relevant information concerning the nature and extent of the breach, its likely impact, the measures taken or proposed to mitigate the risks, and the steps that affected Data Principals may take to protect themselves. Griyon will also take reasonable steps to prevent the recurrence of similar breaches and maintain appropriate records of the incident and remedial measures.

11. Your Rights as a Data Principal

Subject to applicable law and the commencement and applicability of the relevant provisions of the Digital Personal Data Protection Act, 2023, you may have the right to access information about the personal data processed by Griyon, request correction or updating of inaccurate or incomplete personal data, request erasure of personal data where permitted by law, withdraw your consent at any time without affecting the lawfulness of processing undertaken before such withdrawal, and raise grievances regarding the processing of your personal data with Griyon’s Grievance Officer and, where applicable, the Data Protection Board of India. Where provided under applicable law, you may also nominate another individual to exercise your rights in the event of your death or incapacity. Withdrawal of consent or deletion of personal data may affect your ability to access or use certain features of the App. You may exercise your applicable rights by contacting Griyon through the contact details provided in Clause 22 of this Privacy Policy, and Griyon will process and respond to such requests within the timelines prescribed under applicable law.

12. Account Deletion and Data Deletion Requests

12.1 How to delete your account

12.2 What happens when you delete your account

Your account is closed immediately. You are signed out on all devices, and your profile, listings, tales, comments and reviews are no longer visible to anyone.

12.3 30-day restore period

For 30 (thirty) days after deletion, you can restore your account by signing in again with the same phone number or email address and choosing to restore it. Your profile and content are then restored as they were. If someone else has taken your username in the meantime, you will be given a new username. During this period your phone number and email address cannot be used to create a new account. An account closed by Griyon for violating the Terms & Conditions cannot be restored this way.

12.4 After 30 days

After the 30-day period, we permanently delete or anonymise your personal information, and your phone number and email address can be used to create a new account.

12.5 Information that is kept

13. Children's Policy

Griyon is strictly intended for and may be used only by individuals who are 18 years of age or older. The App is not directed towards, and Griyon does not knowingly permit the registration or use of the App by, any person below 18 years of age. By registering for or using the App, you represent and confirm that you have attained the age of 18 years. Griyon does not knowingly collect or process personal data of individuals below 18 years of age. If Griyon becomes aware that an account has been created or personal data has been collected from a person below 18 years of age, Griyon may suspend or terminate the account and take reasonable steps to delete the associated personal data, subject to any information that Griyon is required or permitted to retain under applicable law.

14. Location Services

The App uses location information (precise or approximate) to power location-based discovery of nearby businesses, listings and users. You may enable or disable location permissions at any time through your device settings; disabling location will limit or disable location-based features but will not prevent you from using other parts of the App.

15. Media Uploads (Camera, Photos, Microphone)

Griyon may request access to your device’s camera, photos or microphone only when required to enable you to voluntarily upload or share photographs or videos (including the sound recorded with a video) through your profile, business listing, tales or other applicable features of the App. Such media will be processed and stored on Griyon’s servers or authorised cloud-storage systems for as long as reasonably necessary to provide the relevant feature or while the associated content remains active on the App, subject to applicable law and the retention and deletion requirements set out in this Privacy Policy. You may manage or withdraw the relevant device permissions through your device settings; however, disabling such permissions may limit or prevent access to features that require them.

16. OTP Verification

We use SMS-based and/or email-based, One-Time Password verification solely to confirm ownership of the phone number or email address provided during registration and login. OTP codes are time-limited, are not used for any purpose beyond verification, and associated SMS/verification logs are retained only as deemed necessary subject to the applicable laws.

17. Analytics and Crash Reporting

Griyon may use third-party analytics and crash-reporting services to monitor the performance, stability, security and usage of the App and to identify and resolve technical issues. Such services may collect information including device information, device identifiers, usage data, diagnostic information, crash reports and other technical data necessary for these purposes. The information collected through these services will be processed in accordance with this Privacy Policy and, where applicable, the privacy policies of the respective service providers. Griyon will use such information only for legitimate business and technical purposes, including analysing App performance, improving features, detecting technical issues and enhancing the security and reliability of the App.

18. Grievance Officer / Data Protection Contact

Griyon has designated a Grievance Officer to address questions, requests and complaints relating to this Privacy Policy and the processing of personal data. You may contact the Grievance Officer using the details provided below. Griyon will acknowledge and address grievances and data-protection requests within the time periods and in accordance with the procedures prescribed under applicable law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable, and the Digital Personal Data Protection Act, 2023 and the rules made thereunder, as and when the relevant provisions become applicable to Griyon.

Where applicable under the Digital Personal Data Protection Act, 2023, you are required to first avail yourself of Griyon’s grievance redressal mechanism before approaching the Data Protection Board of India in accordance with applicable law.

19. Updates to this Policy

We may update this Policy from time to time to reflect changes in our practices, the App's features, or applicable law. We will notify you of material changes through the App and/or by other reasonable means, and will indicate the date of the most recent revision at the top of this Policy. Your continued use of the App after such changes constitutes acceptance of the revised Policy.

20. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Any dispute, controversy or claim arising out of or relating to this Policy, including its interpretation, validity, performance or termination, shall, in the first instance, be resolved through arbitration in accordance with the Arbitration and Conciliation Act, 1996, as amended from time to time. The seat and venue of arbitration shall be Ernakulam, Kerala, India, and the arbitration shall be conducted by a sole arbitrator mutually appointed by the parties, failing which the arbitrator shall be appointed in accordance with applicable law. The arbitration proceedings shall be conducted in English, and the arbitral award shall be final and binding on the parties, subject to remedies available under applicable law. Nothing in this clause shall prevent Griyon or any User from seeking urgent interim or protective relief from a competent court or from pursuing any remedy or proceeding which is not capable of being referred to arbitration under applicable law. Subject to the foregoing arbitration agreement and applicable law, the competent courts at Ernakulam, Kerala, India, shall have exclusive jurisdiction over all court proceedings arising out of or relating to this Policy, including proceedings concerning interim relief, appointment of an arbitrator, challenge or enforcement of an arbitral award, or any dispute that is not legally capable of being resolved through arbitration.

22. Contact Us

If you have any questions, concerns, or requests regarding this Policy or our data practices, please contact us at: