Legal Document

Privacy Policy

This Privacy Policy describes how Vylot and its affiliates collect, use, share, protect, or otherwise process your personal information through our website https://vylothq.web.app/ (the "Platform").

Effective Date: May 2026 · Version 1.0 · India Processing
1

Introduction

This Privacy Policy describes how Vylot and its affiliates (collectively "Vylot", "we", "our", "us") collect, use, share, protect, or otherwise process your information and personal data through our website https://vylothq.web.app/ (the "Platform").

Please note that you may be able to browse certain sections of the Platform without registering with us. We do not offer any product or service under this Platform outside India and your personal data will primarily be stored and processed in India.

By visiting this Platform, providing your information, or availing any product or service offered on the Platform, you expressly agree to be bound by this Privacy Policy, the Terms of Use, and applicable service or product terms and conditions, and agree to be governed by the laws of India, including privacy and data protection laws. If you do not agree, please do not use or access our Platform.

2

Collection

We collect your personal data when you use our Platform, services, or otherwise interact with us. This includes information provided during sign-up, registration, or other interactions such as name, date of birth, address, telephone or mobile number, email address, and any information shared as proof of identity or address.

Some sensitive personal data may be collected with your consent, such as bank account details, credit or debit card information, other payment instrument information, or biometric information such as facial features or physiological data when you opt to use certain features on the Platform, all in accordance with applicable law.

You always have the option not to provide information by choosing not to use a particular service or feature on the Platform. We may track your behaviour, preferences, and other information you choose to provide. This information may be compiled and analysed on an aggregated basis.

We also collect information related to your transactions on the Platform and third-party business partner platforms. When a third-party business partner collects your personal data directly from you, you will be governed by their privacy policies. We are not responsible for the third party's privacy practices or the content of their privacy policies, and we request that you read those policies before disclosing any information.

If you receive an email or call from a person or association claiming to be Vylot seeking personal data like debit or credit card PINs, net banking or mobile banking passwords, do not provide such information. If you have already revealed such information, report it immediately to an appropriate law enforcement agency.

3

Usage

We use personal data to provide the services you request. To the extent we use your personal data to market to you, we will provide you the ability to opt out of such uses.

We use your personal data to assist sellers and business partners in handling and fulfilling orders; enhance customer experience; resolve disputes; troubleshoot problems; inform you about offers, products, services, and updates; customise your experience; detect and protect against error, fraud, and other criminal activity; enforce our terms and conditions; conduct marketing research, analysis, and surveys; and as otherwise described to you at the time of collection.

You understand that your access to products or services may be affected if you do not provide required permissions.

4

Sharing

We may share your personal data internally within our group entities, corporate entities, and affiliates to provide you access to the services and products offered by them. These entities and affiliates may market to you unless you explicitly opt out.

We may disclose personal data to third parties such as sellers, business partners, service providers, logistics partners, prepaid payment instrument issuers, third-party reward programs, and other payment providers chosen by you. These disclosures may be required to provide you access to services and products, to comply with legal obligations, to enforce user agreements, to facilitate marketing and advertising activities, and to prevent, detect, mitigate, and investigate fraudulent or illegal activities related to our services.

We may disclose personal and sensitive personal data to government agencies or authorised law enforcement agencies if required by law or in good faith belief that such disclosure is reasonably necessary to respond to subpoenas, court orders, or other legal process.

We may disclose personal data to law enforcement offices, third party rights owners, or others in good faith belief that such disclosure is reasonably necessary to enforce our Terms of Use or Privacy Policy; respond to claims that content violates a third party's rights; or protect the rights, property, or personal safety of users or the general public.

5

Security Precautions

To protect your personal data from unauthorised access, disclosure, loss, or misuse, we adopt reasonable security practices and procedures. Once your information is in our possession or whenever you access your account information, we adhere to our security guidelines to protect it against unauthorised access and offer the use of a secure server.

However, transmission of information over the internet is not completely secure. By using the Platform, users accept the security implications of data transmission over the internet and the World Wide Web, which cannot always be guaranteed as completely secure, and therefore there are inherent risks with use of the Platform.

Users are responsible for ensuring the protection of login and password records for their account.

6

Data Deletion and Retention

You may delete your account by visiting your profile and settings on our Platform. This action will result in you losing all information related to your account. You may also write to us at the contact information provided on the Platform to assist with these requests.

We may refuse or delay deletion in the event of any pending grievance, claim, pending shipment, or any other services. Once the account is deleted, you will lose access to the account.

We retain your personal data for a period no longer than required for the purpose for which it was collected or as required under any applicable law. However, we may retain data if we believe it is necessary to prevent fraud or future abuse or for other legitimate purposes. We may continue to retain your data in anonymised form for analytical and research purposes.

7

Your Rights

You may access, rectify, and update your personal data directly through the functionalities provided on the Platform.

8

Consent

By visiting our Platform or providing your information, you consent to the collection, use, storage, disclosure, and processing of your information on the Platform in accordance with this Privacy Policy.

If you disclose personal data relating to other people, you represent that you have the authority to do so and permit us to use the information in accordance with this Privacy Policy.

You consent to us, our corporate entities, affiliates, lending partners, technology partners, marketing channels, business partners, and other third parties contacting you by SMS, instant messaging apps, call, and email for the purposes specified in this Privacy Policy.

You have the option to withdraw your consent by writing to the Grievance Officer using the contact information provided on the Platform and including “Withdrawal of consent for processing personal data” in the subject line of your communication. We may verify such requests before acting. Withdrawal of consent will not be retrospective and will be in accordance with the Terms of Use, this Privacy Policy, and applicable laws. If you withdraw consent, we reserve the right to restrict or deny the provision of services for which such information is necessary.