PadosXO Privacy Policy

Introduction and Scope

PadosXO is a hyper-local discovery and community platform that helps people discover nearby businesses and places, share recommendations, and connect with local communities. This privacy policy explains what personal data PadosXO collects, how and why it is used, and the choices users have regarding their information. It applies to all services offered by PadosXO through our mobile application and website.

The policy reflects Indian law and global privacy principles. India's Digital Personal Data Protection Act (DPDP Act) requires that organisations process digital personal data lawfully, fairly and transparently, limit the processing to the stated purpose, collect only what is necessary, keep data accurate and up to date, store data only for as long as needed and implement reasonable safeguards against unauthorised processing. Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous. PadosXO designs its privacy practices around these principles.

Information We Collect

We collect information when you create an account, use our services or interact with the platform. The categories of personal data we collect include:

We do not intentionally collect sensitive personal data such as health information, financial data or government identifiers. We ask that you not post sensitive personal information about yourself or others. Any content containing personal information about another person should only be uploaded with their consent.

• Account information: name, username, email address or phone number, password or login token, and profile details. We also collect optional profile information, such as profile photo and biography, if you choose to provide it.
• Location and address: We collect your device's location and your address when you enable location permissions or enter address details. This information allows us to showcase relevant details about your neighbourhood, assign you to the correct one, and show nearby places, events, and communities.
• User-generated content: pins, reviews, comments, photos, videos, posts, messages and other contributions you create on PadosXO. We may collect metadata associated with this content, such as the date and time of upload or device information.
• Device and usage data: device type, operating system, app version, IP address, browser information, log files, unique device identifiers and usage statistics. We use this data for analytics, service provision and security.
• Business listings: if you claim or manage a business on PadosXO, we collect contact details, business descriptions and related information.

How We Use Information

We use personal data to provide, maintain and improve PadosXO. Specifically, we use data to:

• Deliver services and personalise content. Location data helps surface nearby businesses and events. Account information allows us to manage user profiles and authenticate your access. User-generated content is displayed to others as you intend. Device and usage data help us troubleshoot and improve performance.
• Maintain trust and safety. We review posts and take action against content that violates our community standards. We may use automated systems and human review to detect spam, fake engagement or abusive behaviour. Device identifiers may be used to prevent abuse and fraud.
• Communicate with you. We send service communications, such as verification codes, account notices or changes to our policies, respond to your enquiries and provide customer support. If you opt in, we may send marketing messages or notifications about new features.
• Comply with legal obligations and defend rights. We may use data to comply with applicable laws, regulatory requirements or court orders. We may also use data to investigate and respond to claims, enforce our terms and protect our rights and the rights of users and third parties.

Legal Basis for Processing

PadosXO primarily relies on user consent to process personal data. Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous and given through a clear affirmative act. Consent may be withdrawn at any time by contacting us or using in-app settings.

In some cases, we process personal data for legitimate interests, such as improving our services, preventing fraud, or enabling business communications. We ensure that such processing does not override your fundamental rights. We may also process data to perform a contract, for example to provide requested services, or to comply with legal obligations or respond to lawful requests from courts or regulators.

Location Permissions

PadosXO relies on location data to offer hyper-local discovery. We will request your device's location permission when you first install the app or when you use features that require location. You can choose to allow precise location, approximate location, or deny access altogether. If you deny or revoke location permission, some location-based features may not work, but you can still browse and contribute content. We do not access your location in the background without permission, and you can change your preferences at any time within your device settings.

Data Sharing and Third-Party Services

PadosXO does not sell personal data. We may share information in the following situations:

• Service providers: We use trusted third-party service providers to host our platform, analyse data, provide customer support, process payments for premium features and send communications. Service providers may have access to personal data only as necessary to perform their functions under strict confidentiality and data-protection obligations.
• Business interactions: If you interact with a business through PadosXO, for example by claiming a listing, requesting an appointment or messaging a business, we may share your contact information and request with the business so that it can respond.
• Legal or safety reasons: We may disclose information when required by law, in response to a court order, or to comply with lawful requests from public authorities. We may also share information if we believe it is necessary to protect the rights, property or safety of PadosXO, our users or others.
• Corporate changes: In the event of a merger, acquisition, or asset sale, user information may be transferred as part of that transaction. We will notify users and honour the commitments made in this policy.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy. Under the DPDP Act's principle of data minimisation, personal data must be erased once the purpose of collection has been served. Accordingly:

If you close your account, we will delete or anonymise your personal data, except where we need to keep it to comply with legal obligations, resolve disputes or enforce our agreements.

• Account information is retained as long as your account remains active and as required by law or our contractual obligations.
• User-generated content, including pins, reviews and comments, remains on PadosXO until you delete it or your account, or until we remove it for policy violations.
• Location data is stored only as long as needed to provide our services and may be retained in aggregate form for analytics.
• Device and usage data are retained for a limited period for security and analytics purposes, then deleted or anonymised.
• Where we are required by law or by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules to retain blocked content and associated records for a certain period, for example 90 days for take-down requests, we comply with those requirements.

User Rights

Under the DPDP Act and emerging Indian privacy jurisprudence, individuals have several rights, including the right to access, correct, and erase personal data, as well as the right to withdraw consent. To exercise these rights, please contact our Data Protection Officer as described below. We will respond within a reasonable time. You may also have the right to data portability and to object to certain processing.

Where we rely on consent for cookies or marketing communications, you may manage your preferences through our cookie banner or unsubscribe links. Consent can be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to provide and improve our services. The DPDP Act requires businesses to obtain explicit user consent for the use of cookies and other forms of data processing. We therefore:

Cookies are small text files placed on your device to collect data such as IP address, device type, pages visited and preferences. Common cookies we use include analytics cookies to understand usage patterns, functional cookies to remember settings like language or region and advertising cookies for any future advertising features. You can also adjust your browser settings to refuse cookies or to alert you when cookies are being sent.

• Present a cookie banner when you first visit our website. Cookies are not set until you click Accept or otherwise give unambiguous consent. Consent is the only legal basis we use for cookies under the DPDP Act.
• Explain the purpose of each cookie, for example analytics, preferences or advertising, and allow you to manage preferences. General consent is sufficient under Indian law and you do not need to provide separate consent for each purpose.
• Store your consent choice and allow you to withdraw or modify it at any time. When you withdraw consent, we stop processing your data and delete or anonymise any data collected through cookies.

Data Security Practices

PadosXO implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and destruction. The DPDP Act and the Information Technology Act require data fiduciaries to adopt reasonable security safeguards to prevent personal data breaches. Our measures include:

In the unlikely event of a personal data breach, we will notify affected users and the Data Protection Board of India as required by law.

• Encryption of data in transit, such as HTTPS, and at rest where appropriate.
• Access controls and authentication to limit data access to authorised personnel.
• Regular security assessments, vulnerability testing and incident response planning.
• Employee training on privacy and data protection.

Children's Privacy

PadosXO is intended for users aged 18 and above. Under the Indian Majority Act, a person attains majority at the age of 18. The DPDP Act requires verifiable parental consent before processing children's data and prohibits targeted advertising to children. We do not knowingly collect personal data from children under 18. If we become aware that a minor has provided us with personal data without parental consent, we will take steps to delete such data.

Policy Updates

We may update this privacy policy from time to time to reflect changes in our practices or legal obligations. We will notify you of significant changes through in-app notifications, email or by posting a prominent notice on our website. The Last updated date at the top of the policy indicates when it was revised. This policy was last updated on March 9, 2026.

Contact Information

If you have questions or concerns about this policy or wish to exercise your data protection rights, please contact our Data Protection Officer.

You may also lodge a complaint with the Data Protection Board of India if you believe that our processing of your personal data violates applicable law. However, we encourage you to contact us first so that we can try to resolve your concerns. Our Grievance Officer under the Information Technology Rules is the same as the Data Protection Officer named above.