Privacy Policy — MARS

This Privacy Policy explains how Alif Retail Solutions Private Limited ("the Company", "we", "us", "our"), which operates the MARS mobile application, collects, uses, stores, shares, and protects your personal data when you use MARS and related services (collectively, the "Service").

We are committed to handling your data in accordance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") of India;
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The Consumer Protection (E-Commerce) Rules, 2020;
• All other applicable Indian laws.

By using MARS, you ("you", "the User", or "the Data Principal") consent to the practices described in this Policy. If you do not agree, please do not use the Service.

1. Who We Are (Data Fiduciary)

For the purposes of the DPDP Act, Alif Retail Solutions Private Limited is the Data Fiduciary responsible for determining the purpose and means of processing your personal data. MARS is the brand name of the mobile application operated by the Company.

Company details:

• Legal name: Alif Retail Solutions Private Limited
• Entity type: Private company limited by shares, incorporated in India under the Companies Act, 2013
• CIN: U62012KA2026PTC223257
• GSTIN: 29ABGCA0424N1ZJ
• Registered office / principal place of business:
  1st Floor, H.No. 1, Ward No. 25, TS No. 239/6,
  Infantry Road 3rd Cross, Cantonment,
  Surya Colony, Ballari,
  District Ballari, Karnataka 583104, India
• Contact email: support@themarsapp.com
• Grievance Officer: support@themarsapp.com (see Section 14)

2. Eligibility

Use of MARS is available only to persons who are competent to enter into a contract under the Indian Contract Act, 1872. Persons who are "incompetent to contract" within the meaning of that Act — including minors and un-discharged insolvents — are not eligible to use the Service.

At sign-up, you accept our Terms of Service and this Privacy Policy via a checkbox. Your acceptance, together with the date and time it was given, is recorded against your account.

If we discover that we have collected personal data from a person who is not competent to contract, we will delete that data promptly. If you believe a minor has provided us their data, please contact us at the email in Section 14.

Per Section 9 of the DPDP Act, processing of children's data requires verifiable parental consent. We do not currently operate a verified-parental-consent system; the eligibility restriction above is the safeguard.

3. Categories of Personal Data We Collect

3.1 Information you provide directly

Note on retailer payment modes: a retailer can record which payment methods their physical shop accepts (for example Cash, UPI, Card) so shoppers know what to expect in store. This is a descriptive attribute of the shop. It is not a payment instrument, and no account, card or UPI identifier is collected with it.

3.2 Information collected automatically

3.3 Information from third parties

3.4 Sensitive Personal Data or Information (SPDI)

Under the SPDI Rules, "sensitive personal data" includes financial information, passwords, and similar categories. MARS:

• Does not collect or process any financial information. We do not operate a payment gateway and do not accept payments through the Service. No debit/credit card number, CVV, UPI ID, UPI PIN, bank account number or net-banking credential is ever requested, transmitted or stored by us. See Section 4.3.
• Stores your account password (if used) only as a one-way bcrypt hash (salted, 10 work-factor rounds) — never in plain text.
• Stores OTPs only as one-way bcrypt hashes, valid for 5 minutes.

3.5 Data we do not collect

We do not collect:

• Any payment or financial instrument data (see Section 3.4);
• Aadhaar numbers (we do not request UIDAI-protected identifiers);
• PAN, Voter ID, or other government IDs;
• Biometric data (fingerprints, facial scans);
• Background location (only foreground location with your active permission);
• Contacts, SMS messages, or call logs;
• Health data, sexual orientation, religious or political views.

4. How We Use Your Data (Purposes of Processing)

We process your personal data only for the following specified, explicit, and legitimate purposes:

1. Account creation and authentication — verifying your phone number via OTP, recording your acceptance of these documents, maintaining your session via JSON Web Tokens.
2. Service delivery — showing you nearby stores, products, offers and promotions; enabling reviews; delivering clips/short videos; letting you save shops and products.
3. Communications — sending you OTPs, transactional push notifications, support replies, and (for retailers) WhatsApp-based product listing assistance.
4. Analytics and improvement — measuring how features are used (profile views, product views, taps on directions, etc.) to improve the Service and give retailers performance dashboards.
5. Safety, security, fraud prevention — detecting and preventing abuse, fake listings, or unauthorized access.
6. Legal compliance — responding to lawful requests from courts, regulators, and law-enforcement agencies in India.
7. Marketing — only with your consent — sending promotional notifications, which you can disable at any time in the app or by replying "STOP" to WhatsApp messages.

We rely on the following legal grounds under Section 6 of the DPDP Act:

• Consent — for all non-essential processing (e.g., marketing, optional profile data);
• Legitimate use — for processing necessary to provide a service you have asked for (e.g., showing you nearby stores after you grant location permission), comply with law, or respond to a medical/security emergency, as defined in Section 7 of the DPDP Act.

4.3 Payments and in-app purchases — none at present

The Service currently charges nothing. Retailer features that are described in the app as paid — product-listing plans and promotional ad slots — are provided free of charge during our launch period. The app contains no payment gateway and no checkout flow, and the prices shown alongside those features are indicative of future pricing only.

Accordingly:

• We do not process payments, and we have no payment processor.
• We do not collect, see, transmit or store any card, UPI or bank credential.
• No order is placed and no money changes hands through MARS.

In-app ordering and delivery are not currently offered. Shoppers use MARS to discover shops and products, save them, and navigate to the physical store; any purchase happens in person, directly with the retailer, outside the Service. We are not a party to it.

If we later introduce payments or in-app ordering, we will update this Policy and the Terms of Service, give notice in the app, and — where the law requires it — obtain your fresh consent before any such processing begins.

5. Permissions Requested by the Mobile App

We never request background location, contacts, SMS, or call-log access.

6. Local Storage and Device Identifiers

Because MARS is a mobile application, we do not use web cookies. We do, however, store the following on your device:

• Your sign-in tokens are held in the device's own hardware-backed secure store — the iOS Keychain or the Android encrypted keystore — and are excluded from device backups. They are cleared when you sign out or delete your account. On the rare device where the secure store is unavailable or unreadable, the app keeps the session in ordinary app storage for that session only and tells you so in its logs; it never silently downgrades its own security guarantee.
• AsyncStorage (ordinary app storage) holds non-sensitive items: your push notification token, your interface preferences and cached listing data. These are cleared by logging out or reinstalling the app.
• Expo Push Token — an opaque identifier assigned by Expo / Apple / Google to deliver notifications. It is not used to track you across other apps.

7. How We Share Your Data

We share personal data only with the recipients and for the purposes listed below. We do not sell personal data to anyone.

7.1 Service providers (Data Processors)

Each provider is contractually bound (via their standard terms or a data-processing agreement) to use your data only as instructed by us, to apply reasonable security, and to assist us in honouring your rights.

We have no payment processor, because we do not process payments (Section 4.3).

7.2 Between users on the platform

• Retailers, when you write a review of their store or products, or when you contact them through the Service, will see your public name, profile picture and the content you submitted.
• Other users can see your public name, profile picture, reviews, and comments you post on clips. They do not see your phone number, email, or address.

7.3 Legal disclosures

We may disclose personal data when we believe in good faith that it is required to:

• Comply with a binding order from a court, regulator, or law-enforcement agency in India under the DPDP Act, IT Act, or the Bharatiya Nagarik Suraksha Sanhita, 2023;
• Protect the rights, property, or safety of the Company, our users, or the public;
• Investigate fraud, security incidents, or violations of our Terms of Service.

7.4 Business transfers

If the Company is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will notify you and the Data Protection Board of India where required, and the recipient will be bound by terms consistent with this Policy.

8. Cross-Border Transfers

Some of our service providers process data outside India (Cloudinary, Expo, Meta, Google Maps & Places, etc., listed in Section 7.1). Our backend infrastructure is hosted on Google Cloud Platform in the Mumbai (asia-south1) region, so server-side data is processed within India.

Under Section 16 of the DPDP Act, the Central Government may notify countries to which personal data may not be transferred. We will not transfer your personal data to any country that is so notified. At present, no such restrictive notification applies to the countries listed above.

We rely on the service providers' standard contractual commitments to maintain protection equivalent to that under Indian law.

9. Data Retention and What Happens When You Delete Your Account

9.1 Retention while your account is active

We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, or as required by law.

Because we neither process payments nor accept orders (Section 4.3), we hold no payment records and no transaction or order history, and the 7-year retention that tax and GST law imposes on such records does not currently arise.

9.2 What happens when you delete your account

When you tap Profile → Delete account in the app and confirm, the following happens immediately:

A. Erased (removed entirely):

• Your name, mobile number, email address, password, address and city
• Your profile picture — both the reference to it and the stored image itself, which is deleted from Cloudinary
• Your push notification token (your device stops receiving notifications immediately)
• Your style preferences and interests
• Your saved products and saved shops
• Your recently-viewed product list
• Your follow relationships (both sides)
• Notifications addressed to or sent by you
• Comments and likes you posted on clips
• Reviews you wrote on products

A2. The empty record we keep:

Your account row itself is not dropped from the database. What remains is a marker — an internal identifier, your account type, the date the account was created and the date it was deleted — with every field listed in A above erased from it. It holds no personal data and cannot be used to identify you or to sign in, and there is no way to restore an account from it.

We keep it so that the anonymised records described in C below remain accountable: without this marker those records point at nothing, and we could no longer tell a retained record belonging to a since-deleted account apart from a corrupted one. Keeping an empty marker lets us account for our own retained data without keeping anything about you.

B. If you are a retailer, additionally deleted entirely:

• Your retailer profile (store name, address, hours, social links, accepted payment modes)
• All products you listed
• All offers and announcements you created
• All clips you uploaded
• All promotional slots you booked
• All store reviews about your store
• All retailer-side analytics events

C. Anonymised but retained (to preserve aggregate accuracy):

• Behavioural analytics events — user reference nulled, leaving only the event type and timestamp
• Clip interaction events — user reference nulled
• Store reviews you wrote about other retailers — user reference nulled, so retailer aggregate ratings remain accurate but cannot be traced to you

D. Media on Cloudinary — what we can and cannot delete:

Your profile picture is deleted from Cloudinary when you delete your account.

Other media you uploaded — product photos and clips — is removed from the app and can no longer be reached through MARS, because the records that referenced it are deleted. However, the underlying image and video files are not currently destroyed on Cloudinary, and remain retrievable by anyone holding the direct file URL, which is unguessable but not secret. We are correcting this. Until we do:

• If you want your uploaded product photos or clips destroyed at the storage layer as well, email us at support@themarsapp.com from your registered address, or include the request when you delete your account, and we will purge those files manually within 30 days.
• We will update this Section when automatic purging is in place.

D2. Other records beyond our direct control:

• Push notification delivery records held by Expo / Apple / Google follow those providers' retention policies (typically 90 days).
• OTP delivery logs held by MSG91 follow that provider's retention policy.

E. Irreversible: Once you confirm deletion in the app, your account cannot be restored. You may sign up again with the same phone number, but you will start as a new user with no history.

F. Your signed-in devices: Any device still signed in to the account stops working immediately. Deletion revokes the access and refresh tokens held on your phone, so the next action the app takes returns you to the sign-in screen rather than continuing to work until the token would have expired on its own.

10. Your Rights as a Data Principal

Under Chapter III of the DPDP Act, you have the following rights:

10.1 Right to Access (Section 11)

You may request a summary of the personal data we hold about you, the purposes for which it is being processed, and the identities of any data fiduciaries / data processors with whom your data has been shared.

Email support@themarsapp.com with your registered phone number; we will respond within 30 days.

10.2 Right to Correction and Erasure (Section 12)

• Correction of inaccurate, misleading, incomplete, or outdated data: edit in-app via Profile → Edit Profile, or email us.
• Erasure (deletion) of personal data that is no longer necessary: use the in-app Profile → Delete account option for a full and immediate deletion. See Section 9.2 for exact behaviour, including the limitation described in Section 9.2(D).

You may also email us if you wish only specific fields to be erased without deleting the whole account.

10.3 Right to Grievance Redressal (Section 13)

You may file a complaint about how we handle your personal data with our Grievance Officer (see Section 14). We will respond within the time limit prescribed by the DPDP Rules.

10.4 Right to Nominate (Section 14)

You may nominate another individual to exercise your rights in the event of your death or incapacity. To register a nominee, write to us at the email in Section 14.

10.5 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. Some features may no longer be available after withdrawal (for example, you cannot use the navigation feature if you withdraw location consent).

11. Security Measures

We follow reasonable security practices and procedures as required by Section 8 of the DPDP Act and Rule 8 of the SPDI Rules. Specifically:

• Encryption in transit: all communication between the app, our servers, and our service providers uses HTTPS / TLS;
• Password and OTP hashing: stored using bcrypt with a salt and 10 work-factor rounds;
• Token security: JSON Web Tokens signed with a secret known only to our server. Access tokens expire within 7 days and refresh tokens within 60 days; both are revoked immediately on account deletion;
• On-device credential storage: your sign-in tokens are held in the device's own hardware-backed secure store — the iOS Keychain, or Android's encrypted keystore — and are excluded from device backups, so they are not written to ordinary app storage or copied off your phone in readable form;
• Access control: server-side authorization checks on every protected endpoint, including the account-deletion endpoint;
• Rate limiting: caps on OTP requests, password attempts, and login frequency;
• No financial data to protect: because we operate no payment gateway, no card, UPI or banking credential exists anywhere in our systems to be exposed;
• Backups: encrypted, regularly tested;
• Vendor due diligence: we work only with reputable, contracted processors.

No system is perfectly secure. If you suspect unauthorized access to your account, contact us immediately at the email in Section 14.

12. Data Breach Notification

If a personal data breach occurs that is likely to result in significant harm to you, we will notify you and the Data Protection Board of India without undue delay, in accordance with Section 8(6) of the DPDP Act and the DPDP Rules.

13. Marketing Communications

• Push notifications: transactional notifications (OTPs, account and listing updates) are essential and cannot be turned off without uninstalling the app. Promotional notifications are opt-in; you can disable them at any time in the app's notification settings.
• WhatsApp messages: reply "STOP", "UNSUBSCRIBE", or "MUTE" to any WhatsApp message we send you to opt out of further messages.
• In-app promotions: ads from retailers appear in your feed; you cannot opt out of these without ceasing to use the Service.

14. Grievance Officer

In accordance with Section 8(9) of the DPDP Act and Rule 5(9) of the IT Rules 2021, our Grievance Officer can be contacted at:

• Name: Syeda Shaistha Tarannum
• Designation: Grievance Officer, Alif Retail Solutions Private Limited
• Email: support@themarsapp.com
• Postal address: 1st Floor, H.No. 1, Ward No. 25, TS No. 239/6, Infantry Road 3rd Cross, Cantonment, Surya Colony, Ballari, District Ballari, Karnataka 583104, India
• Response time: We aim to acknowledge complaints within 48 hours and resolve them within 30 days, in line with the DPDP Rules.

If you are not satisfied with our response, you may approach the Data Protection Board of India under Section 27 of the DPDP Act.

15. Third-Party Links

The Service may contain links to third-party websites or apps (for example, Google Maps, retailer social media pages). We are not responsible for the privacy practices of those third parties. We recommend reading their privacy policies.

16. Children

As stated in Section 2, MARS is available only to persons competent to enter into a contract under the Indian Contract Act, 1872 — which excludes minors. We do not knowingly process the personal data of children. If you are a parent or guardian and believe your child has provided us personal data, contact us and we will delete it.

We do not engage in behavioural monitoring of children or target advertising directed at children, as prohibited by Section 9(3) of the DPDP Act.

17. Updates to This Policy

We may update this Policy from time to time to reflect changes in the law, our practices, or the Service. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Post a notice within the app;
• Send a push notification to active users;
• Where required by law, ask you to re-consent before continuing to use the Service.

Continued use of the Service after a Policy update constitutes your acceptance of the updated Policy.

18. Contact Us

For any privacy-related question, complaint, or rights request:

• Email: support@themarsapp.com
• Grievance Officer: support@themarsapp.com
• Postal: Alif Retail Solutions Private Limited, 1st Floor, H.No. 1, Ward No. 25, TS No. 239/6, Infantry Road 3rd Cross, Cantonment, Surya Colony, Ballari, District Ballari, Karnataka 583104, India

Appendix A — Summary of Processing Activities

No payment or order activity appears in this table because none is carried out — see Section 4.3.

Appendix B — What Account Deletion Removes (at a glance)

Appendix C — Glossary

• DPDP Act: Digital Personal Data Protection Act, 2023 (India).
• Data Principal: the individual to whom personal data relates — i.e., you.
• Data Fiduciary: the entity (Alif Retail Solutions Private Limited) that determines the purpose and means of processing personal data.
• Data Processor: an entity that processes personal data on behalf of a Data Fiduciary (e.g., Cloudinary, MSG91).
• Personal Data: any data about an identifiable individual.
• Sensitive Personal Data: subset that includes financial information, passwords, biometric data, etc., as defined in the SPDI Rules.
• Processing: any operation performed on personal data — collection, storage, use, sharing, deletion, etc.
• Anonymisation: removing identifiers so a record can no longer be linked to a specific individual.
• Hard delete: permanent removal of a record from our database, with no recoverable copy.

This Privacy Policy describes the MARS app's data practices as at the effective date above and applicable Indian law as at that date. It does not constitute legal advice. We recommend that a qualified legal practitioner review this Policy before publication, and that it be revised before any payment, ordering or delivery feature is enabled.