Effective Date: April 10, 2026

This Privacy Policy describes how SoTrue Technologies Pvt. Ltd., a company incorporated under the laws of India, having its registered office at Building No./Flat No.: HD-036, No 8/2A, 8/2B, 9, Amarajyothi Muss, M/S Golf Link Software Park, Udhay VJ Realty Pvt. Ltd., near Challaghatta Village, Challaghatta, Bengaluru, Bengaluru Urban, Karnataka, 560071, collects, uses, processes, stores, shares, and protects personal data of users accessing the SoTrue platform.

References to “SoTrue”, “we”, “us”, or “our” refer to this entity and its affiliates.

By accessing or using SoTrue, you agree to the collection and use of your personal data in accordance with this Privacy Policy.

Scope and Applicability

This Privacy Policy applies to all users of the platform, including viewers, filmmakers, production houses, distributors, licensors, rights holders, advertisers, and any individuals interacting with SoTrue across mobile applications, web interfaces, filmmaker dashboards, content management systems, rewards programmes, and related services.

Categories of Personal Data Collected

SoTrue collects personal data that you provide directly, including your name, email address, phone number, profile information, and account credentials.

We also collect content related data, including films, shows, segmented content units (“Slices”), full length content streams, audio, images, reactions, chats, collections, and other user interactions within the platform. Slices are structured segments of full length films and shows and together represent the complete content experience.

The platform collects behavioural data, including viewing patterns, engagement patterns including Slice consumption behaviour, full length viewing behaviour on supported devices, reactions, collection activity, interactions within private chats, search queries, preferences, interaction patterns, responses to content, quest participation, reward redemption activity, XP accumulation, level progression, tier status, streak activity, filmmaker interactions, and other engagement patterns.

As part of the platform’s engagement systems, SoTrue may collect and process information relating to participation in quests, rewards programmes, XP systems, levels, tiers, streaks, collections, and other platform participation mechanisms.

As part of the platform’s core functionality, SoTrue may collect and process interaction signals that reflect how users respond to content, including emotional engagement indicators expressed through platform features.

For filmmakers, production houses, distributors, licensors, rights holders, and other authorised content owners, the platform may collect and process information relating to filmmaker verification, content ownership, licensing rights, distribution activity, monetisation participation, payment information, tax related information, content performance, audience analytics, and related platform services.

Technical data such as IP address, device identifiers, browser type, operating system, log data, and usage metadata is collected to ensure platform performance, security, analytics, fraud prevention, and service reliability.

Purpose of Processing

SoTrue processes personal data to operate and improve the platform, enable content discovery, personalise user experience, facilitate platform interactions, ensure platform safety, prevent misuse, and comply with legal obligations.

Data is also used to develop recommendation systems, improve content relevance, enhance engagement models, optimise platform features, administer rewards programmes, facilitate quest participation, manage XP systems and level progression, verify filmmakers, administer monetisation programmes, generate audience insights, provide filmmaker analytics, prevent abuse of platform engagement systems, and support future advertising and commercialisation initiatives.

Personal data may also be processed to investigate violations of platform policies, detect fraudulent activity, enforce legal rights, resolve disputes, comply with regulatory obligations, and maintain the integrity and security of the platform.

Behavioural and Emotion Based Processing

A defining feature of SoTrue is its ability to personalise content and experiences based on user interaction patterns.

The platform may analyse behavioural signals, including engagement patterns and emotional interactions voluntarily provided by users through platform features, to better understand content preferences and improve content discovery, recommendation systems, audience analytics, filmmaker insights, platform engagement models, and future advertising capabilities.

Such inferences are probabilistic and may not always reflect actual user intent. These systems are designed to enhance relevance and user experience and are not intended to manipulate or cause harm.

SoTrue implements safeguards designed to reduce bias, avoid harmful amplification, and promote the responsible use of such information.

The platform may continue to develop and improve audience intelligence systems, recommendation systems, emotional engagement models, content discovery systems, and related technologies in accordance with applicable law.

Advertising and Personalisation

SoTrue may display advertisements, sponsored content, commercial communications, promotional content, and other forms of brand or marketing integrations.

Advertising and personalisation systems may take into account user activity, content interactions, preferences, behavioural signals, contextual information, and emotional interactions voluntarily provided through platform features.

Advertising may also be influenced by contextual factors including content being viewed, engagement patterns, platform activity, and inferred content preferences.

Certain advertising, sponsorship, audience intelligence, and monetisation systems may be under development and may not yet be publicly available on the platform.

All advertising practices are designed to comply with applicable Indian laws and industry guidelines. Where feasible, data used for advertising is processed in aggregated, anonymised, or de identified form.

Users may be provided with controls to manage personalisation preferences where applicable.

Legal Basis for Processing

SoTrue processes personal data in accordance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and related regulatory requirements.

Personal data may be processed based on user consent, contractual necessity, legitimate platform operations, compliance with legal obligations, protection of user safety, prevention of fraud and misuse, and other lawful grounds recognised under applicable law.

Where consent is required, users are provided with appropriate mechanisms to grant, manage, or withdraw consent, subject to operational requirements and applicable legal obligations.

Withdrawal of consent may affect the availability or functionality of certain platform features where processing is necessary for the operation of such features.

Filmmaker Analytics and Monetisation Reporting

SoTrue may provide filmmakers, production houses, distributors, licensors, rights holders, and authorised content owners with access to audience analytics, engagement insights, emotional interaction trends, content performance information, monetisation reporting, and related platform intelligence.

Such reporting may be generated using aggregated, anonymised, platform generated, or engagement derived information and is intended to support content distribution, audience understanding, platform participation, filmmaker services, and future monetisation opportunities.

Such reporting may include audience engagement trends, content performance metrics, emotional interaction trends, collection activity, retention indicators, distribution analytics, and monetisation related information.

SoTrue may also process information necessary to administer filmmaker verification procedures, content ownership reviews, monetisation programmes, payout processes, tax compliance requirements, and related filmmaker services.

Information generated through filmmaker analytics and monetisation systems may be used to improve platform functionality, audience engagement models, content performance measurement, advertising systems, and future commercial offerings.

Data Sharing and Disclosure

SoTrue may share personal data with trusted service providers, contractors, vendors, and technology partners engaged to support the operation, maintenance, security, analytics, content delivery, communication systems, payment infrastructure, cloud services, filmmaker services, rewards programmes, and other legitimate platform functions.

Personal data may also be disclosed to government authorities, regulatory bodies, law enforcement agencies, courts, or other competent authorities where required under applicable law, legal process, judicial order, regulatory direction, or governmental request.

Where reasonably necessary, personal data may be shared in connection with the investigation, prevention, detection, enforcement, or resolution of fraud, security incidents, intellectual property violations, platform abuse, monetisation abuse, unlawful activity, or violations of the Terms of Use, Community Guidelines, or applicable laws.

In connection with filmmaker services, SoTrue may share information with payment processors, verification providers, compliance partners, tax service providers, content protection vendors, advertising partners, and other service providers necessary to administer filmmaker verification, monetisation programmes, distribution services, audience analytics, and related platform functions.

Where possible and appropriate, information may be disclosed in aggregated, anonymised, pseudonymised, or de identified form.

SoTrue does not sell personal data to third parties.

Data Retention

Personal data is retained only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, provide platform services, administer filmmaker services, comply with legal obligations, resolve disputes, prevent fraud, protect platform integrity, and enforce legal rights.

The applicable retention period may vary depending on the nature of the information, the purpose for which it was collected, legal requirements, operational needs, security considerations, and contractual obligations.

Upon expiry of applicable retention periods, personal data may be deleted, anonymised, aggregated, archived, or otherwise processed in accordance with applicable law and internal retention policies.

Certain information relating to platform security, legal compliance, content ownership, intellectual property disputes, financial transactions, filmmaker verification, monetisation programmes, enforcement actions, and regulatory obligations may be retained for longer periods where required or permitted by law.

User Rights

Subject to applicable law, users may have the right to access personal data relating to them, request correction of inaccurate or incomplete information, request deletion of personal data, withdraw consent where consent forms the basis of processing, and seek information regarding the processing of personal data.

Users may also request information regarding categories of personal data collected, purposes of processing, categories of recipients with whom information has been shared, and other information required under applicable law.

The exercise of such rights may be subject to verification procedures, legal limitations, technical feasibility, security requirements, protection of the rights of others, and obligations imposed by applicable law.

Requests relating to personal data may be submitted through designated channels made available by SoTrue.

All requests shall be assessed and processed in accordance with applicable legal and regulatory requirements.

Data Security

SoTrue implements reasonable technical, organisational, administrative, and security measures designed to protect personal data against unauthorised access, disclosure, alteration, destruction, misuse, loss, or accidental exposure.

Such measures may include access controls, authentication mechanisms, monitoring systems, encryption technologies, security reviews, risk assessments, incident management procedures, and other safeguards appropriate to the nature of the information being processed.

Access to personal data is restricted to authorised personnel, service providers, contractors, and partners who require such access for legitimate operational, legal, compliance, security, or service related purposes.

While SoTrue employs reasonable safeguards designed to protect personal data, no system, network, transmission method, or storage mechanism can guarantee absolute security.

Users acknowledge that the transmission of information over the internet and electronic communication networks involves inherent risks beyond the reasonable control of SoTrue.

Data Breach and Incident Response

In the event of a security incident, unauthorised access event, data breach, or other compromise involving personal data, SoTrue shall assess the nature, scope, severity, and potential impact of the incident and take appropriate steps to contain, investigate, mitigate, and remediate the situation.

Where required under applicable law, SoTrue may notify affected individuals, regulatory authorities, government agencies, or other relevant parties within prescribed timelines.

Corrective actions may include technical remediation, security enhancements, process improvements, access restrictions, monitoring measures, incident reviews, and other actions reasonably necessary to reduce the likelihood of recurrence. Nothing in this Privacy Policy shall be interpreted as creating a guarantee that unauthorised access, security incidents, cyber attacks, or data breaches will never occur.

Children’s Data Protection

SoTrue is not intended for unsupervised use by individuals under eighteen years of age.

The platform may implement age based restrictions, content classifications, access controls, parental safeguards, and other protective measures designed to promote age appropriate access and user safety.

Where required under applicable law, SoTrue may implement parental consent mechanisms, age verification procedures, or additional protections relating to the processing of personal data associated with minors.

If SoTrue becomes aware that personal data has been collected from a minor in a manner inconsistent with applicable law, reasonable steps may be taken to restrict access, remove the information, obtain appropriate authorisation, or otherwise comply with applicable legal requirements.

User Controls and Rights

SoTrue may provide users with controls that allow them to access, update, correct, manage, or delete certain account information and platform preferences.

Where available, users may manage account settings, communication preferences, notification preferences, personalisation preferences, advertising preferences, and other platform controls through designated interfaces.

Users may also request access to personal data, correction of inaccurate information, withdrawal of consent, restriction of certain processing activities, or deletion of personal data through designated channels.

The availability of specific controls may vary depending on platform functionality, legal requirements, technical limitations, security considerations, and the nature of the processing activity.

The exercise of user controls and rights remains subject to applicable law and legitimate operational requirements of the platform.

Advertising and Data Sharing Transparency

SoTrue may use personal data to support advertising, sponsored content, commercial communications, audience measurement, campaign effectiveness analysis, and related platform functions.

This may include the use of behavioural information, engagement patterns, content interaction signals, contextual information, preferences, and emotional interactions voluntarily provided through platform features.

Advertising systems may utilise aggregated, anonymised, pseudonymised, or de identified information where appropriate to improve relevance, performance measurement, audience understanding, and platform monetisation capabilities.

Limited information may be shared with advertising partners, analytics providers, measurement providers, service providers, and technology partners where necessary to support advertising delivery, campaign measurement, fraud prevention, audience analytics, monetisation programmes, and platform functionality.

SoTrue does not sell personal data to third parties.

Where required under applicable law, users may be provided with controls relating to advertising personalisation and related preferences.

Tracking Technologies and Analytics

SoTrue may use tracking technologies, analytics tools, diagnostic systems, cookies, software development kits, device identifiers, log data, and similar technologies to understand user behaviour, improve platform performance, support platform security, and enhance user experience.

These technologies may be used to analyse platform usage, measure engagement, understand content performance, evaluate recommendation systems, administer rewards programmes, prevent abuse, detect fraud, improve advertising systems, and optimise platform functionality.

Information collected through such technologies may include device information, usage information, technical information, engagement data, performance data, and other platform interaction signals.

Third party analytics providers, advertising technology partners, cloud service providers, and related vendors may assist SoTrue in analysing platform performance and supporting operational requirements.

Where required by law, users may be provided with controls relating to cookies, tracking technologies, or related data collection practices.

Automated Decision Making and AI Transparency

SoTrue may use automated systems, recommendation technologies, machine learning models, artificial intelligence systems, and related technologies to improve content discovery, audience understanding, platform engagement, content relevance, filmmaker services, advertising capabilities, and user experience.

These systems may analyse user behaviour, engagement patterns, content interactions, search activity, collection activity, emotional interactions voluntarily provided through platform features, and other platform signals.

Automated systems may be used to personalise content recommendations, improve discovery experiences, support filmmaker analytics, optimise advertising systems, administer engagement programmes, identify abuse, and enhance platform functionality.

Users are not subject to decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of applicable law.

These systems are designed to improve platform functionality and are subject to ongoing review, testing, monitoring, and safeguards intended to reduce bias, improve accuracy, and prevent harm.

Account Deletion and Data Retention

Users may request deletion of their account through available platform settings or by contacting SoTrue through designated channels.

Upon initiating account deletion, the account will be placed in a deactivation state for a period of thirty days. During this period, the user may log back into their account and cancel the deletion request, in which case the account and associated data will be restored as it existed prior to the deletion request.

If the user does not log in or cancel the deletion request within this thirty day period, the account will be permanently deleted. Following completion of the deletion process, personal data associated with the account may be deleted, anonymised, aggregated, or otherwise processed in accordance with applicable legal requirements and operational obligations.

Certain information may be retained where necessary for compliance with legal obligations, fraud prevention, security purposes, intellectual property enforcement, dispute resolution, contractual obligations, regulatory requirements, filmmaker services, monetisation programmes, or other legitimate purposes permitted by law.

Non-identifiable information, aggregated information, anonymised information, and platform analytics may be retained beyond account deletion where permitted under applicable law.

Grievance Redressal and Data Contact

For concerns relating to privacy, personal data, data protection, consent, user rights, or this Privacy Policy, users may contact SoTrue through the details provided below.

Grievance Officer Details

Name: Prithviraj Prasad

Email: prithvirajprasad@sotrue.co.in

Phone Number: +91 97420 22212

Address: SoTrue Technologies Pvt. Ltd., Flat No. HD-036, No 8/2A, 8/2B, 9, Amarajyothi Muss, M/S Golf Link Software Park, Udhay VJ Realty Pvt. Ltd., Near Challaghatta Village, Challaghatta, Bengaluru Urban, Karnataka, 560071

Requests, complaints, and grievances shall be acknowledged and addressed in accordance with applicable legal and regulatory requirements.

SoTrue may request additional information where reasonably necessary to verify identity, investigate complaints, process requests, or comply with applicable law.

Cross Border Data Transfers

SoTrue may store, process, access, transmit, or transfer personal data through service providers, infrastructure providers, technology partners, or affiliated entities located within or outside India.

Where personal data is transferred outside India, SoTrue shall take reasonable steps to ensure that such transfers are carried out in accordance with applicable legal requirements and that appropriate safeguards are implemented.

Such safeguards may include contractual protections, technical measures, organisational controls, security requirements, regulatory compliance mechanisms, or other lawful transfer frameworks recognised under applicable law.

By using the platform, users acknowledge that personal data may be processed in jurisdictions that may have data protection laws different from those applicable in India.

Updates and Amendments

SoTrue reserves the right to update, modify, revise, or replace this Privacy Policy from time to time to reflect changes in applicable laws, regulatory requirements, platform functionality, filmmaker services, monetisation programmes, advertising systems, rewards programmes, data processing activities, security practices, or operational requirements.

Updated versions of this Privacy Policy shall become effective upon publication on the platform or through other reasonable means of communication.

Continued access to or use of the platform following the publication of an updated Privacy Policy constitutes acknowledgement of the revised Privacy Policy and continued processing of personal data in accordance with its terms, subject to applicable law.