PRIVACY POLICY - Amora AI

Effective Date: 29th April 2025

1. Introduction

HereNow AI Labs Private Limited, a company incorporated under the Companies Act 2013 and having its registered office at A23/16V PH3, MANGAL APT. V. ENCLAVE, East Delhi, New Delhi‑110096 ("Company", "we", "our", "us"), owns and operates the software‑as‑a‑service platform branded "Amora AI" ("Platform"). We are committed to protecting the privacy of every individual who ("User", "you", "your") accesses or uses the Platform, our website https://amora.ai ("Site") or any related services (collectively, "Services").

This Privacy Policy is published in compliance with:

• Section 43A and Section 72A of the Information Technology Act 2000 ("IT Act");
• the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"); and
• the Digital Personal Data Protection Act 2023 ("DPDP Act") together with all subordinate rules and regulations (collectively, "Applicable Data Laws").

2. Definitions

Unless the context otherwise requires, capitalised terms have the meanings set out below.

• "Child" means an individual who has not completed 18 years of age.
• "Data Fiduciary", "Data Principal" and "Personal Data" have the meanings assigned under the DPDP Act.
• "Processing" means an operation performed on Personal Data and includes collection, storage, use, disclosure, transmission, erasure or destruction.
• "Sensitive Personal Data or Information" ("SPDI") has the meaning under Rule 3 of the SPDI Rules and includes passwords, financial data, health data, biometric data and such other data as may be notified.

3. Scope and Application

This Policy governs the Processing of Personal Data collected from:

1. restaurant owners, managers and their personnel who subscribe to the Platform ("Restaurant Users");
2. end‑customers who scan a QR code, interact with our AI‑powered assistant, or otherwise place orders via the Platform ("Diners"); and
3. visitors to the Site or any other individual whose Personal Data we Process in connection with the Services.

4. Categories of Personal Data Collected

Category	Examples	Collected from	Legal Basis*
Identity Data	full name, business name, CIN, PAN, GST IN	Restaurant Users	Contract, Consent
Contact Data	email address, phone number, postal address	All Users	Contract, Consent
Transaction Data	order details, payment amount, payment instrument metadata (only the last four digits & issuer), refund details	Diners	Contract, Legitimate Interest
Usage Data	log files, IP address, browser type, time‑zone, device identifiers, click‑stream data, in‑app actions, session recordings	All Users	Legitimate Interest
Preference Data	cuisine preferences, dietary restrictions, past orders	Diners	Consent
SPDI	UPI VPA, card token, health‑related dietary info	Diners	Explicit Consent
Children's Data	same as above but relating to a Child	Diners	Consent from parent/guardian

*Legal Basis refers to the grounds recognised under Applicable Data Laws for Processing the relevant Personal Data.

5. Purposes of Processing

We Process Personal Data for the following purposes and no other:

1. Contractual necessity – to create and administer accounts, authenticate log‑ins, provide and personalise the Services, generate KOTs, and process payments.
2. Legitimate interests – to monitor, analyse and improve the Platform, prevent fraud, enforce our terms, carry out business transfers or restructurings, and defend legal claims. We ensure that such interests do not override Users' fundamental rights.
3. Compliance with law – to meet obligations under the IT Act, DPDP Act, taxation laws and other applicable statutes or court orders.
4. Consent – to send marketing communications, enable dietary‑based recommendations, and collect feedback. You may withdraw consent at any time without affecting prior Processing.

6. Disclosures & Cross‑Border Transfers

We do not sell Personal Data. We may share Personal Data strictly on a need‑to‑know basis with:

• Processors – cloud hosts (e.g., AWS), payment gateways, analytics providers and customer‑support tools, each bound by written contracts incorporating Article 12 of the DPDP Act and Rule 5 of the SPDI Rules;
• Business Partners – restaurants receiving order information; and
• Authorities – regulators, courts and law‑enforcement agencies when legally required. Where Personal Data is transferred outside India, we ensure the destination country offers an adequate level of protection or appropriate safeguards are in place (e.g., standard contractual clauses).

7. Data Retention

Personal Data is retained only for as long as (i) necessary to fulfil the purposes stated in Section 5, or (ii) required under applicable law (e.g., tax and accounting records for 8 years), whichever is later. Thereafter, data is securely anonymised or erased.

8. Security Measures

We implement reasonable and industry‑standard technical and organisational measures, role‑based access, multi‑factor authentication.

9. Data Principal Rights

Subject to exemptions under Applicable Data Laws, you have the right to:

• request access to and confirmation of Processing of your Personal Data;
• seek correction of inaccurate or incomplete Personal Data;
• request erasure when the data is no longer necessary or consent is withdrawn;
• exercise the right to data portability in a structured, machine‑readable format; and
• nominate another individual to exercise your rights in the event of incapacity (DPDP Act Section 12).

Submit requests via tushar@amora.ai. We will respond within 15 calendar days.

10. Grievance Redressal Officer (GRO)

Name: Tushar Khattar
Email: tushar@amora.ai
Address: A23/16V PH3, MANGAL APT. V. ENCLAVE, East Delhi, New Delhi‑110096
Telephone: +91‑9818440197

If you are dissatisfied with our response, you may escalate to the Data Protection Board of India under Section 28 of the DPDP Act.

11. Cookies & Similar Technologies

Cookies, pixel tags and local storage objects are used to recognise repeat visitors, remember preferences and measure campaign effectiveness. You may disable non‑essential cookies via your browser settings; however, some Platform features may not function.

12. Children's Privacy

We do not knowingly collect Personal Data from a Child without verifiable consent of the parent or legal guardian. If we learn that we have collected such data without requisite consent, we will delete it promptly.

13. Changes to this Policy

We may update this Policy to reflect changes in law or our practices. Material changes will be notified via email or prominent notice on the Site at least 7 days before they take effect.

14. Governing Law & Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Courts at New Delhi shall have exclusive jurisdiction over any disputes.