1. Introduction

This Privacy Policy explains how Enclira collects, receives, uses, stores, protects, discloses and otherwise processes personal information and other information in connection with:

• Enclira websites and web applications.
• Enclira mobile applications.
• White-labelled applications and websites powered by Enclira.
• Community, membership and social-networking functionality.
• Communication, messaging and notification services.
• AI-powered services, including IRA and AI-assisted features.
• Forms, surveys, polls, quizzes and feedback functionality.
• Events, meetings and registrations.
• Grievance and service-request functionality.
• Marketplace and service-provider functionality.
• E-commerce, orders and related transactions.
• Subscription and membership services.
• Payments, billing and financial transaction processing.
• Content, media and file-storage functionality.
• Integrations with third-party services.
• Analytics, security and fraud-prevention functionality.
• Other services made available by Enclira from time to time.

This Privacy Policy applies to personal information processed by Enclira directly and, where applicable, describes our role as a service provider, processor, controller or other legally recognized role depending on the nature of the processing and applicable law.

Where you use an Enclira-powered application operated by one of our customers, that customer may have its own privacy policy and may independently determine how your information is collected and used. In those circumstances, the customer may be the primary data controller or equivalent entity for information it provides to or collects through the Enclira platform.

2. Who We Are

The Enclira platform is operated by Enclira Labs Private Limited, India.

For privacy-related questions, requests or complaints, please contact:

• Privacy contact: privacy@enclira.com.
• General contact: support@enclira.com.
• Website: https://www.enclira.com.
• Registered office: Enclira Labs, Arenesha Coworking Space, 6th Floor, The District, Financial District, Nanakramguda, Hyderabad, Telangana 500032, India.

Where required by applicable law, Enclira may appoint or designate a Data Protection Officer, privacy representative or other responsible privacy contact.

3. Scope of This Policy

This Privacy Policy applies to information processed through Enclira services, including information provided:

• Directly by users.
• By organizations using Enclira.
• By administrators or community managers.
• By service providers or vendors.
• Through Customer Applications.
• Through integrations.
• Through payment providers.
• Through social-media or communication platforms.
• Automatically through devices and browsers.
• By other lawful means.

This Policy does not necessarily apply to third-party websites, applications, services or products that are linked to or integrated with Enclira but are operated independently by third parties.

Those third parties may maintain their own privacy policies and terms.

4. Enclira’s Role: Controller, Processor and Service Provider

Enclira operates a multi-tenant technology platform. Consequently, our privacy role may differ depending on the service being provided.

5. Information We May Collect

The information collected depends on how you use Enclira and which features are enabled by the relevant customer.

6. How We Collect Information

We may collect information through:

• Account registration.
• Profile creation.
• Customer organizations.
• Community administrators.
• Forms.
• Surveys.
• Events.
• Purchases.
• Marketplace activity.
• Customer support.
• Mobile applications.
• Websites.
• Cookies and similar technologies.
• APIs.
• Integrations.
• Third-party authentication.
• Payment providers.
• Social-media integrations.
• Communication providers.
• Analytics services.
• Security tools.
• Other lawful sources.

Where information is provided by an organization or another user, the information may not have been collected directly from you.

Where required by applicable law, appropriate notices will be provided regarding such processing.

7. How We Use Information

8. Legal Bases for Processing

Where laws such as the GDPR apply, Enclira may process personal data under one or more lawful bases, including:

• Performance of a contract.
• Compliance with a legal obligation.
• Legitimate interests, where permitted.
• Consent.
• Protection of vital interests.
• Performance of a task carried out in the public interest where applicable.
• Other lawful grounds recognized by applicable law.

Where processing relies on consent, you may withdraw consent subject to applicable law.

Withdrawal of consent does not necessarily affect processing that was lawful before withdrawal or processing based on another lawful basis.

9. Sharing of Information

Enclira may disclose information to the following categories of recipients.

10. White-Label Services

Enclira may provide technology under another organization’s:

• Name.
• Logo.
• Domain.
• Application name.
• Branding.
• User interface.
• Communications identity.

A white-label application may therefore appear to be operated entirely by the customer even though Enclira provides underlying infrastructure and services.

In such circumstances, the customer may determine the purposes of collecting and using certain personal information; Enclira may process that information as a processor or service provider; the customer may have its own privacy policy; the customer may control membership visibility and permissions; Enclira may provide the underlying technical infrastructure; and information may be processed by Enclira’s infrastructure and authorized service providers.

The applicable customer’s privacy notice may therefore contain additional information about processing specific to that community.

11. User-Generated Content

Enclira is a technology platform and may host user-generated content.

Depending on the service configuration, content may be visible to:

• Selected members.
• Groups.
• Administrators.
• Moderators.
• Customers.
• Service providers.
• Other authorized users.

Users should consider the visibility settings before publishing personal information or sensitive content.

Once information is voluntarily shared with other users, Enclira cannot guarantee that other users will respect the intended confidentiality of that information.

12. Communications and Notifications

Enclira may send:

• Account notifications.
• Security alerts.
• Transaction notifications.
• Membership notifications.
• Event reminders.
• Service announcements.
• Push notifications.
• Email.
• SMS.
• Other communications enabled by the customer.

Certain communications are necessary to provide the service and may not be disabled.

Marketing communications may be subject to applicable consent and opt-out requirements.

13. Cookies and Similar Technologies

Enclira may use cookies, SDKs, pixels, local storage and similar technologies for:

• Authentication.
• Session management.
• Security.
• Preferences.
• Analytics.
• Performance.
• Fraud prevention.
• Service functionality.
• Marketing where permitted.

Where legally required, non-essential cookies or similar technologies will be subject to appropriate consent mechanisms.

You may control cookies through browser settings, although disabling certain technologies may affect functionality.

The Enclira Cookie Policy describes these technologies in more detail.

14. Analytics

Enclira may use analytics and monitoring technologies to understand:

• Application performance.
• Feature usage.
• Errors.
• Crashes.
• User journeys.
• Service reliability.
• Aggregated usage patterns.

Analytics providers may receive technical and usage information as necessary to provide these services.

Enclira will configure analytics and tracking technologies in accordance with applicable laws and platform requirements.

15. Third-Party Integrations

Enclira may integrate with services including:

• Payment providers.
• Social-media platforms.
• Email providers.
• SMS providers.
• Messaging providers.
• Authentication providers.
• Cloud providers.
• Analytics providers.
• AI providers.
• Meeting and video providers.
• Storage and content delivery providers.
• Other technology providers.

When you choose to use an integration, information may be exchanged with that third party as necessary to provide the requested functionality.

Third-party services are governed by their own terms and privacy policies.

Enclira does not control the privacy practices of independent third parties.

16. International Data Transfers

Enclira may operate globally and may use service providers located in countries other than the country where you reside.

Consequently, personal information may be transferred to and processed in:

• India.
• The United States.
• European countries.
• The United Kingdom.
• Canada.
• Other countries where Enclira or its service providers operate.

Where applicable law restricts international transfers, Enclira will seek to use appropriate legal mechanisms, such as adequacy decisions, Standard Contractual Clauses, contractual safeguards or other legally recognized transfer mechanisms.

Under GDPR, international transfers are subject to specific requirements intended to preserve the level of protection provided by the Regulation.

17. Data Security

Enclira uses reasonable technical and organizational measures designed to protect personal information against unauthorized access, unauthorized disclosure, alteration, loss, destruction, misuse and accidental disclosure.

Depending on the service and environment, safeguards may include:

• Encryption in transit.
• Access controls.
• Authentication.
• Authorization.
• Logging.
• Monitoring.
• Backups.
• Infrastructure security.
• Vulnerability management.
• Incident-response procedures.
• Segregation of customer environments where applicable.
• Least-privilege access.

No internet-based service can guarantee absolute security.

Accordingly, Enclira cannot guarantee that information will never be compromised, intercepted, altered or destroyed.

Users and customers are responsible for protecting their account credentials and maintaining appropriate security practices.

18. Data Retention

Enclira retains information only for as long as reasonably necessary for the purposes described in this Policy, contractual requirements, legal obligations, dispute resolution, security, fraud prevention and legitimate business purposes.

Retention periods may depend on:

• The type of information.
• The purpose of processing.
• Customer instructions.
• Contractual requirements.
• Legal requirements.
• Financial and tax obligations.
• Security requirements.
• Dispute or litigation requirements.

When information is no longer required, Enclira may delete, anonymize or otherwise securely dispose of it, subject to applicable law and legitimate retention requirements.

Backup systems may retain information for a limited additional period until such backups are overwritten or securely deleted.

19. Account Deletion

Where an account deletion mechanism is required, users may request deletion through the applicable application or by contacting the relevant customer or Enclira.

Account deletion may result in:

• Removal of profile information.
• Deletion or anonymization of user-generated information where appropriate.
• Removal of access.
• Deletion of associated account information.

Certain information may need to be retained where required by law, taxation requirements, accounting requirements, fraud prevention, security, dispute resolution, legal claims or contractual obligations.

Where Enclira processes information on behalf of a customer, deletion requests may need to be directed to that customer, depending on the applicable data-protection relationship.

Google Play currently requires apps that support account creation to provide a clear account-deletion mechanism and to delete associated user data subject to applicable exceptions. Enclira provides that mechanism at enclira.com/account-deletion.

20. Privacy Rights

Depending on your jurisdiction, you may have rights including:

• Right to know whether personal information is processed.
• Right to access information.
• Right to correction.
• Right to deletion.
• Right to restriction of processing.
• Right to object.
• Right to data portability.
• Right to withdraw consent.
• Right to opt out of certain marketing.
• Right to opt out of certain automated decision-making or profiling where applicable.
• Right to lodge a complaint with a supervisory authority.
• Other rights provided by applicable law.

Under GDPR, for example, individuals may have rights including access, rectification, erasure and other rights subject to the conditions and exceptions in the Regulation.

These rights are not absolute and may be subject to legal exceptions.

21. How to Exercise Your Rights

Privacy requests may be submitted to privacy@enclira.com.

Please include enough information for us to reasonably verify your identity and understand the request.

Where Enclira processes information on behalf of an organization, we may refer your request to that organization.

We may request additional information where reasonably necessary to prevent unauthorized disclosure of personal information.

We aim to respond within the time required by applicable law.

22. India — Digital Personal Data Protection

For individuals and processing activities subject to Indian data-protection law, Enclira intends to process digital personal data in accordance with applicable requirements, including the Digital Personal Data Protection Act, 2023 and applicable rules and notifications.

India’s Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology, with provisions subject to a phased commencement timeline.

Where applicable, Enclira may provide notices describing:

• The personal data being processed.
• The purposes of processing.
• Applicable rights.
• Methods for withdrawal of consent.
• Mechanisms for complaints.
• Other information required by applicable law.

23. European Economic Area and United Kingdom

Where GDPR, UK GDPR or equivalent privacy laws apply, Enclira will apply the relevant requirements to processing within their scope.

Depending on the circumstances, Enclira may act as a controller, a processor, a joint controller where legally applicable, or another legally recognized role.

Where Enclira acts as a processor, the relevant customer generally remains responsible for determining the purposes and means of processing and for satisfying its controller obligations.

Where required, Enclira may enter into appropriate data-processing agreements and implement appropriate safeguards for international transfers.

Individuals in the EEA or UK may exercise rights available under applicable law using the contact information in this Policy.

24. United States Privacy Rights

Privacy laws vary by U.S. state.

Where applicable, Enclira may provide rights required by state privacy laws, which can include rights concerning:

• Access.
• Correction.
• Deletion.
• Portability.
• Opt-out of certain processing.
• Targeted advertising.
• Sale or sharing of personal information.
• Profiling.
• Nondiscrimination.

The exact rights available depend on the user’s jurisdiction and whether Enclira or the relevant customer is subject to that law.

Enclira does not sell personal information for monetary consideration in the ordinary operation of its SaaS platform.

Where applicable law defines certain disclosures, transfers, advertising technologies or data relationships differently, Enclira will comply with the requirements applicable to the relevant processing.

25. Children’s Privacy

Enclira’s general services are not intentionally designed to independently collect personal information from children in violation of applicable law.

Where Enclira services are provided by schools, educational organizations, youth organizations, communities or other customers serving minors, the relevant customer is responsible for configuring and operating the service in accordance with applicable children’s privacy laws and obtaining required parental or guardian permissions where applicable.

Enclira may process information relating to minors when instructed or authorized by a customer and permitted by applicable law.

If you believe a child has provided personal information unlawfully, please contact us. The Enclira Child Safety Standards describe how we prevent, detect and respond to child sexual abuse and exploitation across Enclira-powered services.

26. Sensitive and Special Categories of Information

Certain Enclira features may allow customers or users to process information that may be considered sensitive or special-category information under applicable law.

Examples may include information relating to:

• Health.
• Biometric information.
• Precise location.
• Financial information.
• Political activities.
• Religious or philosophical beliefs.
• Sexual orientation.
• Identity documents.
• Other legally protected categories.

Enclira does not require users to provide sensitive information unless necessary for a particular service.

Customers are responsible for ensuring that they have an appropriate legal basis and safeguards before collecting or processing sensitive or special-category information through Enclira.

Enclira may restrict or prohibit certain categories of sensitive processing where necessary to manage legal, security or operational risk.

27. Financial Transactions

Enclira may provide technology enabling:

• Subscriptions.
• Purchases.
• Donations.
• Memberships.
• Marketplace orders.
• Service payments.
• Refunds.
• Payouts.
• Commissions.
• Other financial transactions.

Enclira may facilitate the technology supporting these activities but is not necessarily the merchant, seller, financial institution, payment processor or beneficiary of each transaction.

Where a third-party payment processor is used, the processor may independently process transaction and payment information.

The relevant merchant, organization, vendor or service provider may also have independent responsibilities regarding pricing, taxes, invoices, refunds, consumer rights, financial records, payment disputes and regulatory compliance.

Enclira does not provide banking, investment, lending, insurance, financial-advisory or payment-processing services merely by providing technology integrations unless expressly stated otherwise.

28. Tax and Accounting Information

Where required for billing, invoicing, taxation or accounting, Enclira may process:

• Billing address.
• Tax identification information.
• Transaction amounts.
• Invoice information.
• Payment information.
• Currency.
• Applicable tax information.

This information may be retained for legally required periods.

29. Fraud Prevention and Abuse Detection

Enclira may process technical, transactional and account information to:

• Detect fraudulent activity.
• Prevent abuse.
• Detect suspicious transactions.
• Protect users.
• Prevent account takeover.
• Protect payment systems.
• Enforce platform policies.

Where permitted by law, automated systems may assist with these activities.

Where applicable law grants rights concerning automated decision-making, Enclira will provide the rights required by that law.

30. Automated Decision-Making and Profiling

Certain Enclira features may use automated processing to:

• Recommend content.
• Prioritize information.
• Detect spam.
• Identify suspicious activity.
• Personalize experiences.
• Classify content.
• Assist administrators.

Enclira does not intend to make decisions producing legal or similarly significant effects solely through automated processing unless permitted by applicable law and appropriate safeguards are implemented.

Where legally required, users may have rights concerning automated decision-making.

31. Data Ownership

As between Enclira and a customer, customer content generally remains owned or controlled by the customer or its users, as applicable.

Enclira does not acquire ownership of customer content merely because the content is stored or processed through the platform.

Enclira may use information necessary to operate, secure, maintain and improve its services as permitted by applicable agreements and law.

32. Aggregated and De-Identified Information

Enclira may create aggregated, statistical or de-identified information that does not reasonably identify an individual.

Such information may be used for:

• Analytics.
• Benchmarking.
• Service improvement.
• Product development.
• Security.
• Research.
• Business reporting.

Where information has been properly anonymized or de-identified under applicable law, it may no longer constitute personal information.

33. Data Breaches and Security Incidents

If Enclira determines that a security incident involving personal information has occurred, Enclira will assess and respond to the incident in accordance with applicable law and contractual obligations.

Where legally required, Enclira may notify:

• Affected customers.
• Affected individuals.
• Regulators.
• Law-enforcement authorities.
• Other relevant parties.

Notifications may be provided through email, application notifications, customer portals, websites or other reasonable means.

34. Third-Party Websites and Services

Enclira may contain links to third-party websites, applications or services.

Enclira is not responsible for third-party privacy policies, third-party security, third-party content, third-party practices or third-party availability.

Users should review the privacy policies of third-party services before providing information.

35. Customer Administrators

Enclira customers may have administrators who can access or manage information within their organization’s Enclira environment.

Depending on the customer’s configuration, administrators may be able to:

• Manage users.
• View profiles.
• Manage groups.
• Access community content.
• Moderate content.
• Manage events.
• Review forms.
• Manage transactions.
• Configure permissions.
• Export information.
• Deactivate accounts.

Enclira does not control how an independent customer administrator uses information within the customer’s environment, except as required by contract or applicable law.

36. Promotional and Marketing Communications

Enclira may send information about:

• New features.
• Product updates.
• Service changes.
• Events.
• Offers.
• Educational material.

Where required, marketing communications will be sent only with an appropriate lawful basis or consent.

You may unsubscribe from marketing communications using the available opt-out mechanism.

Transactional and security communications may continue because they are necessary to provide the service.

37. Do Not Track

Some browsers provide a “Do Not Track” mechanism.

Because there is currently no universally accepted standard for interpreting all such signals, Enclira may not respond to every browser Do Not Track signal unless required by applicable law.

Where applicable law requires recognition of specific privacy preference signals, Enclira will implement them as required.

38. Third-Party AI and Technology Providers

Some Enclira services may rely upon third-party infrastructure providers to deliver AI, hosting, analytics, communications, payments or other functionality.

Enclira may disclose information to such providers only as necessary to provide the relevant functionality, subject to applicable contractual and legal safeguards.

The specific providers used may change over time as Enclira updates its technology infrastructure.

Where appropriate, Enclira may maintain a list of significant subprocessors or provide such information to customers under applicable contractual arrangements.

39. Subprocessors

For services where Enclira acts as a processor, Enclira may appoint third-party subprocessors to process personal information.

Subprocessors may provide:

• Cloud infrastructure.
• Database services.
• Storage.
• CDN.
• Communications.
• Email.
• SMS.
• Push notifications.
• Payment infrastructure.
• Analytics.
• AI infrastructure.
• Monitoring.
• Security.
• Customer support.

Enclira will impose appropriate contractual obligations on subprocessors as required by applicable law and contractual commitments.

40. Your Responsibilities

Users are responsible for:

• Maintaining accurate information.
• Protecting passwords.
• Protecting authentication credentials.
• Using appropriate privacy settings.
• Not sharing credentials.
• Not uploading unlawful information.
• Not uploading information they are not authorized to process.
• Respecting other users’ privacy.
• Complying with applicable laws.

Customers are additionally responsible for configuring their Enclira environment appropriately and providing legally required notices.

41. Changes to This Privacy Policy

Enclira may update this Privacy Policy from time to time.

Changes may be made because of:

• Changes to our services.
• New features.
• Changes to technology.
• Changes to applicable law.
• Regulatory requirements.
• Changes to third-party providers.
• Security improvements.
• Business changes.

We will update the “Last updated” date when the Policy changes.

Where required by applicable law, we will provide additional notice or obtain consent before material changes take effect.

42. Complaints

If you have concerns about Enclira’s privacy practices, please contact privacy@enclira.com.

We encourage you to contact us first so that we can attempt to resolve your concern.

Where applicable law provides the right to lodge a complaint with a supervisory authority or data-protection regulator, you may exercise that right independently.

43. No Absolute Security Guarantee

While Enclira takes reasonable measures to protect information, no technology system, transmission method, network or storage environment can be guaranteed to be completely secure.

Accordingly, Enclira does not guarantee absolute security of information.

44. No Guarantee of Third-Party Privacy Practices

Enclira may rely upon third-party service providers and integrations.

Although we seek to work with reputable providers and implement appropriate contractual and technical safeguards, Enclira is not responsible for independent processing performed by third parties acting outside Enclira’s instructions or contractual relationship.

45. Lawful Use of the Platform

Enclira is a general-purpose technology platform.

Customers and users must not use Enclira to process personal information unlawfully or to violate applicable privacy, consumer-protection, financial, criminal, employment, health, education, political, charitable or other regulations.

Enclira reserves the right to restrict, suspend or terminate processing or services where reasonably necessary to:

• Comply with law.
• Protect users.
• Protect Enclira.
• Prevent abuse.
• Address security risks.
• Comply with contractual obligations.

46. Contact Us

For privacy questions, requests or complaints, contact Enclira Labs Private Limited:

• Privacy: privacy@enclira.com.
• Support: support@enclira.com.
• Website: https://www.enclira.com.
• Registered office: Enclira Labs, Arenesha Coworking Space, 6th Floor, The District, Financial District, Nanakramguda, Hyderabad, Telangana 500032, India.

47. Important Notice for Enclira Customers

If you are an organization using Enclira to provide services to your own members, customers, employees, beneficiaries, clients, students, donors, voters, supporters, vendors or other users, this Privacy Policy does not eliminate your own privacy obligations.

You may need to provide your own privacy notice, determine appropriate lawful bases, obtain required consents, configure permissions, establish retention periods, execute appropriate agreements and respond to individual privacy requests.

Where Enclira processes personal information solely on your behalf, you remain responsible for determining the purposes and lawful basis of that processing, subject to the terms of your agreement with Enclira.

Enclira may provide additional contractual documentation, including a Data Processing Agreement, where appropriate.

48. Effective Date

This Privacy Policy is effective as of 17 August 2026.

Version: 1.0.