PRIVACY NOTICE

A. Introduction

We at SPOC AI Technologies Private Limited (SPOC AI / we / us / our) respect the privacy and confidentiality of the personal data of all individuals whose personal data we process. Our organization upholds the highest standards of data protection, ensuring your personal information is processed securely, ethically, and in accordance with the law. We are committed to implementing policies, practices and processes to safeguard the collection, use and disclosure of personal data, in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) (collectively, the Applicable Law).

B. Applicability of this Privacy Notice

This Privacy Notice applies to SPOC AI’s online workplace productivity tools and platform, including the associated SPOC mobile and desktop applications (collectively, the Services), and our website getspoc.com and other interactions that you may have with SPOC AI.

C. How We Collect Your Personal Data

We collect your personal data in the following ways:

• Directly from you, when you create an account on our platform, verify your mobile number via OTP, complete your user profile, or fill out forms on our website (https://www.getspoc.com/).
• Through your use of our platform and interactions with platform features.
• From the Workspace Creator, if they set up or manage a workspace on our platform and add you as a member.
• Automatically, through cookies, device identifiers, log data, and similar technologies when you visit our website or use our platform.

D. What Personal Data Do We Collect

We collect only the personal data that is necessary for the purposes described in this Privacy Notice. SPOC AI collects and receives information through the Services provided on the platform and Website, and through other interactions with SPOC AI. Such information will include User Content and other information and data (Other Personal Data) in a variety of ways:

User Content - Workspace Creators or Users granted access to a Workspace by a Workspace Creator submit User Content (such as messages, files or other content submitted through Services accounts) which may include personal data to SPOC AI when using the Services of SPOC AI’s platform.

Other Personal Data – SPOC AI also collects, generates and/or receives the following categories of Other Personal Data:

• Account and Profile Data means name. mobile number, profile photo, username or display name and contacts or address book data if you choose to import them.
• Workspace and Business Data means workspace name
• Technical and Device Data means browser type, operating system, device model, network provider, IP address, access location, login and logout times, session duration, pages viewed, features used, links clicked, file types shared, browsing behavior, service metadata, navigation patterns, and other usage logs when linked to your account, device, browser, or session.
• Customer Support Data means support tickets, support chat transcripts, crash logs, error reports, push notification tokens, feedback, survey responses, satisfaction ratings, and any information you provide when asking for help or responding to surveys.
• Security and Audit Data means audit logs, user and administrator actions, timestamps, security event logs, incident logs, data export and deletion request records, and user access request records when linked to an identifiable user, administrator, account, or device.
• Billing and Financial Data means billing contact name, billing email address, billing address, cardholder name, payment method token, failed payment attempt logs, refund records, invoices, transaction history, purchase history, plan type, currency preference, coupon or discount code, billing frequency, and renewal date where linked to an individual contact, cardholder, user, or account.
• Location Data means GPS location of user when shared by user within chat or with AI tool
• Marketing and Communications Data – means workspace administrator name, workspace administrator mobile number, workspace administrator email address, user mobile number, and user email address
• Cookie Data means cookie identifiers, online identifiers, device-level analytics, browsing behavior, and website or platform navigation data where linked to your device, browser, session, account, or use of our services.
• Website Form Data means information you submit through website forms, including your name, mobile number, email address, “Interested in” selection, free-text description, portfolio or LinkedIn URL, résumé, and any other information included in an uploaded file or form field.

E. Why Do We Collect Your Personal Data

User Content is processed by SPOC AI on the instructions of the Workspace Creator for the purpose of providing the Services in accordance with the User Terms and Conditions. SPOC AI is a Data Processor for processing User Content which may include personal data, and the Workspace Creator is the Data Fiduciary. The Workspace Creator may, for example, use the Services to grant and remove access to a Workspace, assign roles and configure settings, access, modify, export, share and remove User Content, and otherwise apply its policies to the Services.

SPOC AI is the Data Fiduciary for the processing of Other Personal Data to provide our services and business operations.

F. How We Manage the Collection and Use Your Personal Data

Obtaining Consent

Before we collect and process Other Personal Data, we will ask for your clear permission. You will always have a real choice, and we will tell you exactly what we plan to do with your personal data before you decide. We will not collect more personal data than is necessary for the stated purpose. We will seek fresh consent from you if the original purpose for which your personal data was collected has changed.

Legitimate Uses

In certain cases, we may process Other Personal Data without obtaining separate consent where permitted by Applicable Law for specified “legitimate uses,” including where you have voluntarily provided the personal data to us for a specified purpose and have not indicated that you do not consent to such use; where processing is necessary for employment-related purposes or to safeguard us from loss or liability, including preventing corporate espionage and maintaining the confidentiality of trade secrets, intellectual property, and classified information; where processing is required to comply with a legal obligation to disclose personal data to the State or its instrumentalities; or where processing is necessary to respond to a medical emergency.

Withdrawal of Consent

You have the right to withdraw your consent at any time. To withdraw your consent or change your consent settings, you may:

• Send an e-mail to us at support@getspoc.com

Upon receiving your withdrawal request, we will, within a reasonable time, cease processing your personal data, unless such processing is required or authorized by Applicable Law.

G. We Disclose Your Personal Data To

We share personal data only when needed for the purposes described in this notice or when the law requires it. We may share personal data with hosting providers, communication providers, push notification providers, domain and internet infrastructure providers, affiliates, professional advisers, auditors, and other service providers who help us provide services to you. We may also disclose personal data to courts, regulators, government authorities, or law enforcement when required or authorized by law.

H. How We Protect Your Personal Data

We implement appropriate technical and organizational measures as well as reasonable security safeguards to ensure a level of security for the personal data appropriate to the risk and to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

The same level of protection is contractually imposed by us on our data processors and service providers with whom personal data is shared for processing on our behalf.

I. How We Retain Your Personal Data

SPOC AI may retain Other Personal Data pertaining to you for as long as necessary for the purposes described in this Privacy Notice (such as to provide the Services, including any optional features that you use, and to provide customer support) and in accordance with the Applicable Law. This may include keeping your Other Personal Data after you have deactivated your account for the period of time needed for SPOC AI to pursue legitimate business interests, conduct audits, comply with legal obligations, resolve disputes and enforce our agreements. Once the purpose has been served and there is no legal requirement for retention, we will erase your personal data.

We will dispose of or destroy records containing Other Personal Data in a proper and secure manner when the retention period ends. We will also direct third parties engaged by us to erase Other Personal Data that was shared with them for processing on our behalf.

J. Children’s Privacy

Our Services are not intended for use by children (individuals below the age of eighteen years). We do not knowingly collect or process personal data of children.

If we become aware that we have collected personal data of a child without verifiable parental consent, we will take steps to delete such data promptly.

If you believe that we may have inadvertently collected personal data from or about a child, please contact us using the details provided in Section L below.

K. Your Rights as a Data Principal

Under the DPDPA, you have the following rights in respect of the Other Personal Data:

• Right to Access Information: You may request a summary of your personal data being processed by us, details of the processing activities undertaken, and the identities of all entities with whom your personal data has been shared.
• Right to Correction, Completion and Updating: You may request us to correct your personal data, complete any incomplete data, or update any outdated personal data that we hold about you.
• Right to Erasure: You may request the erasure of your personal data where it is no longer necessary for the purpose for which it was collected, unless we are required to retain it under any law.
• Right to Withdraw Consent: You may withdraw your consent to the processing of your personal data at any time, in accordance with the process detailed in Section F of this Privacy Notice.
• Right of Grievance Redressal: You have the right to raise a grievance with us regarding the processing of your personal data or the exercise of your rights, and to receive a response within the timeframe set out below.
• Right to Nominate: You may nominate another individual who shall, in the event of your death or incapacity, exercise your rights on your behalf in accordance with Applicable Law.

For exercising any of your rights, you may contact us through Data Principal Access Request webform on www.getspoc.com/terms or e-mail us at support@getspoc.com

L. Grievance Redressal and Contact Information

If you have any queries, concerns or grievances regarding the processing of your personal data, you may contact by E-mail: support@getspoc.com

We will acknowledge and respond to your grievance or requests within a reasonable period not exceeding ninety (90) days from the date of its receipt.

M. Complaint to the Data Protection Board of India

We are deeply committed to protecting your privacy and safeguarding the personal data you entrust to us. We take our obligations under Applicable Law seriously and strive to ensure that all personal data is handled with the highest standards of care, transparency, and accountability.

If you are not satisfied with our response or if any grievance remains unresolved despite our best efforts, you may file a complaint with the Data Protection Board of India through its digital office. The Data Protection Board functions as a digital office and complaints can be submitted online.

N. Changes to this Privacy Notice

SPOC AI may change this Privacy Notice from time to time. Laws, regulations and industry standards evolve, which may make those changes necessary, or we may make changes to our services or business. We will post the changes to this page and encourage you to review our Privacy Notice to stay informed. If we make changes that materially alter your privacy rights, SPOC AI will provide additional notice, such as via email or through the Services. If you disagree with the changes to this Privacy Notice, you should deactivate your Services account. Contact the Workspace Creator if you wish to request the removal of User Content under their control.

Effective Date: 21/10/2026Last Updated: 21/10/2026Version: 1.0.0