Grievance Redressal Policy

Effective date and version: September 20, 2026 (Version 1.0). This document is available in English only and forms part of, and shall be read together with, the Terms of Service and the Privacy Policy.

1. Purpose

1.1 This Policy sets out the manner in which a Data Principal may raise a grievance about the processing of Personal Data by Khypri AI (the “Company”) or about the exercise of their rights under the Digital Personal Data Protection Act, 2023 (the “Act”), and the manner in which the Company shall respond. It supplements Sections 8, 9 and 16 of the Privacy Policy.

2. Who May Raise a Grievance

2.1 A Data Principal, or, in respect of a child, the parent or legal guardian who is the Account Holder, may raise a grievance. A person who is not the Account Holder may raise a grievance about their own Personal Data.

2.2 A grievance may concern, among other matters: a refusal or delay in exercising a right of access, correction, completion, updating or erasure; withdrawal of consent; the processing of a child’s Personal Data; a suspected personal data breach; or any act or omission of the Company under the Act.

3. How to Raise a Grievance

3.1 A grievance shall be sent in writing to the Data Protection Officer, Debasmita Maharana, at dpo@khypri.com, with the subject line “Grievance”.

3.2 The grievance should state the email address registered on the Account, a description of the concern, and the outcome sought. The Company may ask for information sufficient to confirm the identity of the person raising it, so that Personal Data of a child or of another person is not disclosed to an unauthorised person.

4. Response

4.1 The Company shall handle each grievance as follows:

1. Acknowledgement: within three (3) business days of receipt.
2. Resolution: the Company shall aim to resolve a grievance within thirty (30) days of receipt and in any event within the period prescribed by the Act and the rules made under it, and shall tell the Data Principal the outcome and the reasons for it.
3. Records: the Company keeps a record of each grievance, its handling and its outcome.

4.2 Requests to exercise rights are handled in accordance with Section 8 of the Privacy Policy, within the time limits stated there (fifteen (15) days for access, correction and portability and thirty (30) days for erasure).

5. Escalation

5.1 A Data Principal who is not satisfied with the outcome, or who has not received a response within the period stated above, may complain to the Data Protection Board of India once it is operational and in accordance with the Act, and residents of the European Union or European Economic Area may complain to their local supervisory authority.

5.2 The right to complain to the Data Protection Board is generally available only after the grievance has first been raised with the Company. Nothing in this Policy limits any right available under the Consumer Protection Act, 2019 or other law.