LEGAL DOCUMENT

WENSLink Private Limited respects your privacy. This policy explains how KrishoSaathi collects, uses, stores, and protects your personal information in compliance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (India).

We collect the following categories of personal data: IDENTITY DATA: - Mobile phone number (mandatory — for OTP authentication) - Name (optional — for personalised advisory) - Location / Pincode (for weather and price localisation) FARMING PROFILE DATA: - Crop preferences and farming type - Land size (optional) - Irrigation type (optional) USAGE DATA: - Pages visited and features used - Device type, OS, and browser - IP address and approximate location - Push notification preferences PAYMENT DATA (Premium subscribers): - Payment transaction ID (stored by Razorpay — we do NOT store card/UPI details) - Subscription status and history COMMUNICATIONS: - Support emails and messages - Grievance submissions

We use your data strictly for the following purposes: SERVICE DELIVERY: - Authenticating your identity via OTP - Providing localised mandi prices for your state - Delivering personalised weather and farming advisories - Processing premium subscription payments - Sending push notifications and SMS alerts (with your consent) PLATFORM IMPROVEMENT: - Analysing usage patterns to improve features - Debugging and resolving technical issues - Conducting anonymised agricultural research LEGAL & COMPLIANCE: - Complying with applicable Indian laws and regulations - Responding to lawful government or court requests - Enforcing our Terms of Service We do NOT use your data for: - Targeted advertising to third parties - Selling your data to insurance companies, banks, or FMCG brands without explicit consent - Automated decision-making that produces legal effects on you

We share your data ONLY with the following trusted partners: PAYMENT PROCESSING: - Razorpay Software Pvt Ltd — for processing ₹99 premium payments - Razorpay is PCI-DSS Level 1 certified and stores payment data on their secure servers - Privacy policy: https://razorpay.com/privacy AI ADVISORY: - Groq Inc. — anonymised crop queries for AI advisory generation - No personally identifiable information (PII) is shared with Groq GOVERNMENT APIs (data flows from Govt to us): - data.gov.in, eNAM, Agmarknet — price data - Open-Meteo — weather data - Bhashini API — language translation INFRASTRUCTURE: - Hetzner Online GmbH (Germany) — cloud server hosting - Data is stored in encrypted form on Hetzner servers We NEVER share your data with: - Marketing agencies or advertisers - Political parties or campaign organisations - Data brokers or lead aggregators (unless you explicitly opt in to the NBFC credit lead programme)

WHERE WE STORE YOUR DATA: - Primary server: Hetzner VPS, Frankfurt, Germany (EU GDPR compliant infrastructure) - Database: PostgreSQL 16 with encrypted storage - Cache: Redis 7 with password protection - All data is transmitted over HTTPS (TLS 1.2 / 1.3) - SSL certificate: Let's Encrypt (renewed automatically) SECURITY MEASURES: - Network: UFW firewall — only ports 22, 80, 443 open - Docker: 4 isolated networks — no cross-container access - Passwords: bcrypt hashed — never stored in plaintext - API keys: stored in encrypted environment variables - Error monitoring: Sentry (anonymised error tracking) - OTP: 5-minute expiry, 3 attempts/hour rate limiting DATA RETENTION: - Account data: retained until account deletion request - Price and weather cache: 1–7 days rolling window - Payment records: 7 years (as required by Indian tax law) - Support emails: 2 years

Under India's Digital Personal Data Protection Act, 2023, you have the following rights: RIGHT TO ACCESS: - Request a copy of all personal data we hold about you - Email: support@krishosaathi.in with subject "Data Access Request" - Response time: within 30 days RIGHT TO CORRECTION: - Request correction of inaccurate or incomplete data - Update your profile directly in the app, or email us RIGHT TO ERASURE ("Right to be Forgotten"): - Request deletion of your account and all associated personal data - Note: We may retain anonymised usage data and transaction records as required by law - Email: support@krishosaathi.in with subject "Account Deletion Request" - Processing time: within 30 days RIGHT TO GRIEVANCE: - File a complaint with our Grievance Officer at grievance@krishosaathi.in - If unresolved, escalate to the Data Protection Board of India (once operational) RIGHT TO WITHDRAW CONSENT: - Withdraw consent for push notifications via device settings - Withdraw consent for SMS alerts by replying STOP to any SMS - Withdraw consent for data processing by requesting account deletion

KrishoSaathi uses the following minimal tracking technologies: ESSENTIAL (cannot be disabled): - Session tokens — for maintaining your logged-in state - OTP verification cookies — for security ANALYTICS (anonymised): - Sentry error tracking — anonymised error reports only - No Google Analytics or Meta Pixel is currently deployed PUSH NOTIFICATIONS: - Web push subscriptions (VAPID protocol) are stored in our database - You can revoke push notification permission from your browser settings at any time WE DO NOT USE: - Third-party advertising cookies - Cross-site tracking cookies - Fingerprinting technologies

KrishoSaathi is intended for use by farmers and agricultural stakeholders who are 18 years of age or older. We do not knowingly collect personal data from children under the age of 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@krishosaathi.in and we will delete such information within 7 business days. Minor farmers (under 18) may use the platform under the supervision of a parent, guardian, or FPO representative.

DATA PROTECTION CONTACT: Email: privacy@krishosaathi.in (or support@krishosaathi.in) Subject line: "Privacy Request — [Your Name]" Response time: Within 30 days GRIEVANCE OFFICER: Email: grievance@krishosaathi.in Address: WENSLink Private Limited, Guwahati, Assam — 781001, India Response time: Within 48 business hours For payment data concerns, contact Razorpay directly: https://razorpay.com/privacy

Privacy questions?