Privacy

When you use Narada Studios (naradaaisage.com), we collect: • Account Information: Your name, email address, and profile picture (via Google OAuth); or your registered email address (via email/password or email link sign-in) • Creative Inputs: AI prompts you enter (scripts, style directions, character descriptions, voice instructions) • Generated Content: AI-generated scripts, storyboard images, video clips, audio compositions, and trailer outputs • Usage Data: Budget consumed per task, stage completions, model selections, session timestamps • Technical Data: Browser type, device type, operating system, IP address, approximate location (country/city) • Payment Data: Transaction history and amounts via Cashfree; we do not store card numbers, UPI IDs, or banking credentials

When a business subscribes to Digital Dupe (digital-dupe.naradaaisage.com), we collect: • Business Identity: Business name, owner name, email address, phone number, business category, slug/subdomain chosen • Knowledge Base Content: Menus, rate cards, service brochures, product descriptions, FAQs, and any documents uploaded for RAG indexing • Brand Assets: Logos, brand colors, avatar images, product/service showcase media uploaded by the business owner • Subscription & Payment Records: Subscription tier, billing date, transaction history via Cashfree • Dashboard Activity: Conversation monitoring logs, lead export requests, knowledge base update history • Co-Director Referral Data: If your Dupe was sourced by a Co-Director, their partner ID is stored and linked to your subscription for commission tracking We do not sell, share, or use business tenant data for any purpose beyond providing and improving the Digital Dupe service.

When a member of the public interacts with any Digital Dupe deployed on our platform, the following data may be collected on behalf of the subscribing business: • Conversation Logs: The full text of visitor interactions with the Digital Dupe AI agent • Lead Capture Data: Name, verified phone number, and/or WhatsApp number when a visitor engages the Inline Lead Capture Engine ([LEAD_CAPTURE]) • Inquiry Context: Nature of inquiry, product/service of interest, as extracted by the AI during conversation IMPORTANT NOTICE FOR VISITORS: • You are interacting with an AI agent, not a human representative of the business • The business operating this Digital Dupe is the Data Fiduciary for your personal data • Narada Studios acts as a Data Processor — we store and process your data solely on behalf of the subscribing business • For data deletion or access requests regarding a specific Digital Dupe, contact the business directly or email support@naradaaisage.com with the business name

When a user enrols in the Co-Director Growth Program, we collect: • Identity Verification (KYC): PAN card number (masked after verification), Aadhaar number (if Aadhaar path chosen — processed via Cashfree DigiLocker and not stored by us), name as per ID document • Bank Account Details: Account number (last 4 digits stored), IFSC code, bank name — used solely for commission payouts via Cashfree Easy Split • Partner ID: A unique identifier (format: ND-CD-XXXXXX) assigned upon KYC verification • Commission Records: Sales sourced, commission amounts earned, payout status, settlement dates • Sales Activity: Referral links clicked, trial Dupes created under your partner code, conversion status • Chat History: Conversations with Narada Sales Director (persistent across sessions for coaching continuity) • Annual Earnings Tracking: Total commissions earned in the current financial year for TDS compliance (Section 194H of the Income Tax Act)

For Digital Dupe Enterprise subscriptions using the WhatsApp Business Cloud API (Meta): • Conversation Data: Messages exchanged between the Digital Dupe AI agent and your WhatsApp contacts • Contact Numbers: Phone numbers of individuals who message your business WhatsApp number • Opt-in/Opt-out Signals: Records of consent to receive automated messages • Message Templates: Approved outbound templates created for your business CRITICAL DISCLOSURES: • WhatsApp conversations are transmitted via Meta's Cloud API infrastructure; Meta's own privacy policy governs data in transit on their systems • Conversation logs are stored in Narada Studios' secure Firestore infrastructure and are accessible only to the subscribing business owner via their dashboard • We do not use WhatsApp conversation data for AI model training • Narada Studios is not the WhatsApp Business Solution Provider (BSP); we integrate with Meta's Cloud API under Meta's platform terms • You remain responsible as the business operator for obtaining consent from your WhatsApp contacts

We use the data we collect for the following purposes: NARADA STUDIOS & TRAILER DOC: • To provide the AI filmmaking and pre-production services you request • To process payments and manage your wallet balance • To deliver and store your AI-generated content assets • To improve AI model selection and pipeline performance DIGITAL DUPE: • To deploy, manage, and maintain your AI persona and knowledge base • To process subscription payments and manage your billing • To provide you access to your conversation logs and captured leads dashboard • To enable Co-Director commission tracking and attribution CO-DIRECTOR PROGRAM: • To verify your identity (KYC) and register you as a Cashfree Easy Split vendor • To calculate, track, and disburse commission payments • To provide coaching continuity via persistent Sales Coach Narada chat history • To comply with TDS obligations under Indian tax law ALL SERVICES: • To ensure platform security, detect fraud, and prevent abuse • To communicate important service updates, policy changes, and billing notifications • To comply with applicable legal obligations under Indian law

We take steps to protect Personally Identifiable Information (PII) before it enters our AI processing pipelines: • Visitor lead data (name, phone number) captured via Digital Dupe is stored in Firestore and is not passed to external AI model providers (Gemini, fal.ai, ElevenLabs, etc.) as part of model inference • AI system prompts and knowledge bases are compiled without embedding raw PII; visitor details are handled via structured data tags, not as LLM context • Co-Director KYC data (PAN, Aadhaar, bank details) is processed via Cashfree's Secure ID APIs and stored in encrypted form; this data is not passed to AI models • AI-generated content produced by our filmmaking pipeline may be processed by third-party model providers (Google Vertex AI, fal.ai, ElevenLabs, Kling) under their respective data processing terms We are committed to the "Privacy by Design" principle and continuously review our AI pipelines to minimize PII exposure to model inference engines.

We understand that clarity on AI training data usage is essential for your trust. Our position is as follows: • Narada Studios user prompts and generated content are NOT used to train or fine-tune the underlying AI models provided by Google (Gemini), fal.ai, ElevenLabs, Kling, or other third-party providers • Digital Dupe business knowledge bases and visitor conversation logs are NOT used to train shared AI models accessible to other tenants; each tenant's knowledge base is fully isolated • Co-Director chat history with Sales Coach Narada is NOT used to train shared AI models • We may use aggregated, anonymized, and non-personally-identifiable usage patterns (e.g., "which AI models are most used for storyboarding?") to improve our own platform architecture and feature development — this does not involve your content or identity If our policy on AI training data changes materially, we will notify you via email and update this Privacy Policy with at least 30 days' notice before the change takes effect.

Digital Dupe is built on a strict multi-tenant isolation architecture: • Each business Dupe operates under a unique tenant slug (e.g., /tenant/your-business-name) • Each tenant has a dedicated, isolated knowledge store (Google Gemini RAG brain / Vertex AI Discovery Engine); cross-tenant data access is architecturally impossible • Visitor conversation logs are partitioned by tenant slug; no business can access another business's conversations • Business knowledge bases, product catalogs, and brand assets are stored in Firestore collections scoped exclusively to that tenant's UID • Co-Director partner data is scoped to individual partner IDs and is not accessible to other Co-Directors This multi-tenant isolation ensures that a competitor cannot access your pricing, product data, or customer leads through the shared Narada Digital Dupe platform.

• All data is stored on Google Cloud Platform (Firebase Firestore and Cloud Storage) in secure, encrypted data centers • We implement industry-standard security measures including HTTPS/TLS encryption in transit, Firestore security rules, and Firebase Authentication • Payment data is processed by Cashfree (PCI-DSS compliant); we do not store card numbers, full UPI IDs, or banking credentials • KYC data (PAN, bank account details) is stored in encrypted form with access restricted to automated payout systems • We maintain logs of AI-generated content and platform interactions in accordance with India's IT Rules traceability requirements • In the event of a data breach that affects your personal data, we will notify you within 72 hours of discovery as required by applicable Indian law

We work with the following third-party services that may process your data as part of providing our services: AUTHENTICATION & INFRASTRUCTURE: • Google Firebase (Auth, Firestore, Cloud Storage) — firebase.google.com/support/privacy • Google Vertex AI / Gemini — cloud.google.com/terms/data-processing-terms AI MODEL PROVIDERS: • fal.ai — Image/video generation (FLUX.1, Wan, LTX, HunyuanVideo, Stable Audio, Kokoro TTS, F5-TTS) — fal.ai/privacy • ElevenLabs — Voice synthesis (Multilingual TTS) — elevenlabs.io/privacy • Kling / Kuaishou — Video generation (Kling 3.0 T2V & I2V) — via fal.ai • Lyria / Google DeepMind — Music composition (Lyria 3 Pro, Lyria 3 Clip) PAYMENTS & VERIFICATION: • Cashfree Payments — Payment processing, subscription billing, Co-Director KYC (PAN, Aadhaar, Penny Drop), and Easy Split payouts — cashfree.com/legal/privacy • Meta (WhatsApp Business Cloud API) — WhatsApp integration for Digital Dupe Enterprise — facebook.com/privacy/policy COMMUNICATIONS: • Resend / Nodemailer — Transactional email delivery (lead notifications, commission alerts, billing receipts) • Meta Cloud API — WhatsApp Business notifications We recommend reviewing the privacy policies of these third-party services. We will update this list as our service integrations change.

We retain your data for the following periods: NARADA STUDIOS: • Account data (profile, usage history): Retained while your account is active and for 12 months after deletion • AI-generated content (images, videos, scripts): Stored indefinitely while your account is active; deleted within 30 days of account deletion • Payment records and credit history: Retained for 8 years as required by Indian accounting and GST laws • Session logs and IP data: Retained for 90 days for security and fraud prevention DIGITAL DUPE: • Business tenant data and knowledge bases: Retained while the subscription is active and for 30 days after cancellation (to allow data export); permanently deleted thereafter • Visitor conversation logs and lead data: Retained for 12 months from creation; business owners may export or delete earlier via the dashboard • Subscription and payment records: Retained for 8 years CO-DIRECTOR PROGRAM: • KYC verification data: Retained for 8 years as required by financial record-keeping regulations and Section 194H TDS compliance • Commission records and transaction history: Retained for 8 years • Sales Coach chat history: Retained for 24 months from last session You may request account deletion at any time by emailing support@naradaaisage.com. Requests are processed within 30 days.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights as a Data Principal: RIGHT TO ACCESS: You may request a summary of the personal data we hold about you and how it is being processed. RIGHT TO CORRECTION: You may request correction of inaccurate or incomplete personal data. RIGHT TO ERASURE: You may request deletion of your personal data when it is no longer necessary for the purpose it was collected, or when you withdraw consent. Erasure requests are subject to legal retention obligations (tax records, KYC compliance). RIGHT TO NOMINATION: You may nominate a person to exercise your data rights on your behalf in the event of your incapacity or death. RIGHT TO GRIEVANCE REDRESSAL: You may file a complaint with our Grievance Officer (see Section 16) or escalate to the Data Protection Board of India (DPBI) if your complaint is not resolved satisfactorily. To exercise any of these rights, email support@naradaaisage.com with subject line "DPDP Rights Request" and include your registered email address. We will respond within 30 days.

We use cookies and similar tracking technologies to operate and improve our services: ESSENTIAL COOKIES: • Firebase Authentication session cookies (required for login state) • Payment session state during Cashfree checkout flows FUNCTIONAL COOKIES: • User preferences (language, currency toggle INR/USD) • Routing and navigation state within the platform ANALYTICS: • We may use aggregated, anonymized analytics to understand platform usage patterns. Individual user activity is not shared with advertising networks. We do not use third-party advertising cookies or behavioral tracking cookies for ad targeting. For full details on cookies and how to manage them, see our Cookie Policy (/cookies). You may reject non-essential cookies via your browser settings; this may affect some platform functionality.

Narada Studios services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. This applies to all four of our products: • Narada Studios — minimum age 18 • Digital Dupe — minimum age 18 for business subscribers • Trailer Doc — minimum age 18 • Co-Director Program — minimum age 18; KYC verification enforces this requirement If we become aware that a person under 18 has provided us with personal data, we will delete that data within 30 days of discovery. If you are a parent or guardian and believe your child has registered on our platform, please contact support@naradaaisage.com immediately.

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the IT Amendment Rules, 2026, and the Digital Personal Data Protection Act, 2023, our designated Grievance Officer is: Grievance Officer: Name: Srinivasa Rao Maruboyina Designation: Founder & Director, Narada Studios Private Limited Email: invoke@naradaaisage.com Phone: +91 833 100 1525 Address: 401, Akshara Sai Residency, Road No 5, Nizampet, Hyderabad – 500090, Telangana, India Working Hours: Monday to Saturday, 10AM – 6PM IST COMPLAINT PROCESS: 1. Email invoke@naradaaisage.com with subject "Privacy Grievance" 2. Include your full name, registered email, and description of the concern 3. You will receive an acknowledgement within 24 hours 4. Resolution within 30 days of receipt 5. If unsatisfied, you may escalate to the Data Protection Board of India (DPBI) Changes to This Policy: We may update this Privacy Policy periodically. Significant changes will be communicated via email. Continued use after the effective date constitutes acceptance. Last Updated: July 2026