Privacy Policy

Sochmate AI Private Limited ("Company", "we", "us", "our") operates DotBuy, an AI-powered shopping assistant. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

Please read this Privacy Policy carefully. By using DotBuy, you consent to the data practices described in this policy. This policy is compliant with the Information Technology Act, 2000 and applicable rules thereunder, including the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

Registered officeSochmate AI Private LimitedSurapur, Ambedkar Nagar, Akbarpur, Uttar Pradesh, IndiaCIN: U62011UP2025PTC227666Customer care: [email protected]

We collect the following types of information:

2.1 Information You Provide Directly• Full name• Email address• Mobile phone number (verified by OTP at sign-in)• Delivery address(es), including coordinates when you pick a location on the map• Payment information (processed and secured by Razorpay; we do not store full card numbers, CVV or UPI PIN)• Search queries and shopping preferences• Support tickets and the messages you send us

2.2 Information Collected Automatically• Device information (device model, operating system version, and the Android device identifier used to pair your phone with our live-price service)• IP address• Usage data (screens viewed, features used, products opened)• Crash and error logs for debugging, retained for 90 days• Push notification tokens (for order status updates)

2.3 Information from Third Parties• Order status and confirmation data from the quick-commerce platforms we order from on your behalf• Payment status and payment method type from Razorpay

The DotBuy Android app requests the following permissions. Each is used only for the purpose described, is requested at the moment you use the relevant feature, and can be refused or revoked at any time in Android Settings. Refusing a permission disables only the feature it powers; the rest of the app continues to work.

• Location (approximate and precise) — to find quick-commerce stores that deliver to where you are and to fill in your delivery address. Used only while you are using the app, when you tap "use my location". We never collect location in the background.• Camera — for search-by-photo. Images you capture are sent to our visual-search service to identify the product, and are not used to build any profile of you.• Photos and media — so you can pick an existing photo for search-by-photo instead of taking a new one. We read only the image you select.• Microphone — for the push-to-talk voice assistant. Audio is captured only while you hold the microphone button, is transcribed to text, and the audio itself is not retained.• Contacts — only if you tap "pick from contacts" while adding a delivery address, and only to copy the one name and phone number you select. We never read, upload or store your contact list.• Notifications — to send order confirmations and delivery updates.• Foreground service / run in background — to keep the live-price connection described in Section 4 open while a price check is running. A notification is shown whenever it is active.

We do not request or collect: SMS messages, call logs, installed-app lists, calendar, health data, or any device identifier used for advertising.

This section describes the part of DotBuy that is least obvious from the outside, and we want to be explicit about it.

4.1 On-device price checkingQuick-commerce prices depend on your exact location and, on some platforms, on whether you are logged in. To show you accurate prices, the DotBuy app can load a supported platform's own product page inside a hidden browser view on your device, read the price and availability from that page, and send only that extracted price and availability data back to us. The page is loaded from your device, over your connection, in a foreground service that displays a notification while it runs.

We read only product price, pack size, availability and the product image from those pages. We do not read, collect or transmit your order history, saved cards, personal details or any other content from those accounts.

4.2 Connecting a platform accountIf you choose to connect a platform account (for example to see member pricing), you log in on that platform's own website inside the app. We never see or store your password or OTP for those platforms — you enter them directly into the platform's own login page. The resulting login session stays on your device and is used only to read prices and to add items to that platform's cart when you place an order.

You can disconnect a platform at any time from Connected Accounts, and clearing the app's data removes all such sessions.

4.3 Placing your orderWhen you pay, we place the order on the platform you selected on your behalf, sharing the name, phone number and delivery address needed to complete it. You authorise this by completing a payment; see our Terms of Service and Payment & Refund Policy.

We use the information we collect to:

• Create and manage your DotBuy account• Show you accurate, location-specific prices and availability• Process your orders on supported platforms on your behalf• Send you order confirmations, status updates, and delivery notifications• Apply coupon codes and discounts to maximise your savings• Provide customer support and respond to enquiries• Personalise your shopping experience and recommendations• Detect and prevent fraudulent transactions and abuse• Improve our search ranking, product matching and overall service• Comply with legal obligations• Send you service-related communications (not marketing without your consent)

We do not sell your personal information to third parties, and we do not use it for third-party advertising.

We may share your information with:

6.1 Quick-Commerce PlatformsWhen placing orders on your behalf, we share the information necessary to complete the purchase (name, delivery address, phone number) with the platform you selected — Blinkit, Zepto, Swiggy Instamart, BigBasket, Flipkart Minutes, Amazon Now, JioMart, DMart Ready, or another supported platform.

6.2 Payment ProcessorsPayment information is shared with Razorpay (a PCI-DSS compliant payment aggregator) to process transactions securely.

6.3 Service ProvidersWe work with trusted third-party providers for cloud hosting, SMS OTP delivery (MSG91), push notifications (Google Firebase Cloud Messaging), and speech transcription. These providers process data only as instructed by us and under confidentiality agreements.

6.4 Legal RequirementsWe may disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of our users, ourselves, or others.

6.5 Business TransfersIn the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account and profile data: until you delete your account• Delivery addresses, cart, and search history: until you delete your account• Transaction records: retained for 7 years as required by Indian financial regulations, with personal details removed once an account is deleted• Support and communication logs: 2 years• Crash and device logs: 90 days

See Section 8 for how to delete your account.

You can delete your DotBuy account and personal data at any time, and you do not need to contact us to do it.

In the app: Profile → Delete My Account.On the web: https://dotbuy.app/delete-account

Deleted immediately and permanently: your name, email address, phone number, saved delivery addresses, cart and cart history, search history, notification records, support tickets, and the device records holding your push notification token and platform login sessions.

Retained: the transaction records for orders you have already placed, for 7 years, as required by Indian financial regulations. Your name, phone number and delivery address are stripped from these records at the point of deletion, leaving an accounting record rather than personal data.

Please note: any unspent DotBuy Wallet balance is forfeited when you delete your account. Withdraw or spend it first if you wish to keep it.

Deleting your account does not automatically cancel orders already placed on a quick-commerce platform; cancel those on the platform directly.

We implement industry-standard security measures to protect your personal information:

• All data is transmitted using TLS/SSL encryption• Payment data is handled exclusively by PCI-DSS compliant Razorpay, and every payment is verified server-side against Razorpay's signature before an order is confirmed• Access to your account data requires a session token issued only after successful OTP verification of your phone number• Access to personal data is restricted to authorised personnel only• We conduct regular security reviews

While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

As a user, you have the right to:

• Access: Request a copy of the personal data we hold about you• Rectification: Correct inaccurate or incomplete personal data — you can edit your profile and addresses in the app at any time• Erasure: Delete your personal data (see Section 8; subject to the legal retention noted there)• Portability: Receive your data in a structured, machine-readable format• Opt-out: Unsubscribe from marketing communications at any time• Withdraw Consent: Where processing is based on consent, withdraw it at any time — including by revoking any device permission in Android Settings

To exercise any of these rights, contact us at [email protected] or [email protected].

Our website uses cookies and similar technologies to:

• Maintain your login session• Remember your preferences• Analyse usage patterns to improve the Service• Prevent fraud

You can control cookie settings through your browser. Disabling certain cookies may affect the functionality of the Service.

DotBuy is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at [email protected] and we will promptly delete it.

Our Service links to and loads pages from third-party quick-commerce platforms. Your use of those platforms is governed by their own privacy policies. We are not responsible for their privacy practices and encourage you to review them.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page with an updated "Last Updated" date• Sending an email notification to registered users• Displaying a prominent notice in the app

Your continued use of the Service after such changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy:

Sochmate AI Private LimitedSurapur, Ambedkar Nagar, Akbarpur, Uttar Pradesh, IndiaCIN: U62011UP2025PTC227666

Privacy: [email protected]Support: [email protected]Customer care: [email protected]

Grievance OfficerIn accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Consumer Protection (E-Commerce) Rules, 2020:

Name: AmanDesignation: Grievance Officer, Sochmate AI Private LimitedAddress: Surapur, Ambedkar Nagar, Akbarpur, Uttar Pradesh, IndiaContact: [email protected]Acknowledgement: within 48 hours of receiptResolution: within 1 month of receipt

We do not currently operate a telephone helpline. All grievances are received and answered by email at the address above.