PRIVACY POLICY.

This Privacy Policy explains how SQ7 COMMUNICATIONS PRIVATE LIMITED, operating under the brand CITY XO ("CITY XO", "we", "us", or "our"), collects, uses, stores, shares, and protects personal information when you use:

• the CITY XO website;
• CITY XO Progressive Web App;
• CITY XO mobile applications;
• CITY XO Creator Network;
• CITY XO merchant services;
• CITY XO memberships;
• CITY XO events;
• CITY XO bookings;
• CITY XO creator campaigns;
• CITY XO communities; and
• other CITY XO services.

Together, these are referred to as the "Platform" or "Services".

We are committed to handling personal data responsibly and transparently.

This Privacy Policy should be read together with the CITY XO Terms of Use and any additional terms applicable to specific Services.

01WHO WE ARE

SQ7 COMMUNICATIONS PRIVATE LIMITED

Brand: CITY XO

Website: cityxo.com

Registered Office: 985,STREET NO 20,,SADAR BAZAAR,Jabalpur,Jabalpur,Madhya Pradesh,482001-India

Email: [●]

Privacy/Data Contact: [●]

Grievance Contact: [●]

For purposes of applicable Indian data-protection law, CITY XO may act as the entity determining the purposes and means of processing personal data collected through the Platform.

02SCOPE OF THIS POLICY

This Privacy Policy applies to personal information collected through:

• CITY XO websites;
• CITY XO applications;
• creator application forms;
• merchant onboarding forms;
• consumer accounts;
• membership purchases;
• bookings;
• Event purchases;
• Creator Network participation;
• customer support;
• communications with CITY XO;
• marketing interactions; and
• other CITY XO Services.

It applies to information relating to:

• consumers;
• creators;
• merchants;
• merchant representatives;
• event participants;
• business contacts; and
• other individuals who interact with CITY XO.

03INFORMATION WE COLLECT

We collect information that is reasonably necessary to provide and operate CITY XO Services.

The information we collect depends on how you use the Platform.

04INFORMATION PROVIDED DIRECTLY BY CONSUMERS

When you create a CITY XO account, we may collect:

• full name;
• mobile/WhatsApp number;
• email address;
• date of birth;
• gender, where provided;
• city;
• profile photograph, where provided;
• interests;
• account credentials or authentication information; and
• other information you choose to provide.

05CREATOR INFORMATION

When you apply to or participate in the CITY XO Creator Network, we may collect:

• full name;
• Instagram username;
• other social-media usernames;
• WhatsApp number;
• email address;
• date of birth;
• city;
• gender, where provided;
• content categories;
• languages in which you create content;
• social-media profile information;
• follower information;
• engagement information;
• audience information;
• creator rates;
• availability;
• campaign history;
• campaign performance;
• content submitted to CITY XO;
• payment information required for creator payments;
• tax information where required;
• contracts and campaign records; and
• other information necessary to administer creator campaigns.

The current CITY XO Creator Application specifically requests the creator's name, Instagram username, WhatsApp number, email, DOB, city, gender, content category and content languages.

06MERCHANT INFORMATION

When a business joins CITY XO, we may collect:

Business information

• legal/business name;
• brand name;
• business category;
• business description;
• business address;
• location information;
• phone number;
• email;
• website;
• social-media accounts;
• business photographs and videos;
• menus;
• offers;
• membership information;
• event information; and
• booking information.

Representative information

• owner's name;
• authorized person's name;
• phone;
• email;
• identification and verification information where required.

KYC/business information

Depending on the business and applicable requirements:

• PAN;
• GSTIN;
• bank account information;
• business registration information;
• licences;
• permits;
• business proof; and
• other verification documents.

07TRANSACTION INFORMATION

When you purchase or book through CITY XO, we may collect:

• product/service purchased;
• Membership purchased;
• Merchant;
• booking details;
• Event details;
• ticket details;
• table reservation details;
• Transaction amount;
• discounts;
• promotional codes;
• payment status;
• refund status;
• Transaction identifiers;
• creator attribution information; and
• related customer-service information.

Where payment processing is handled by a third-party payment provider, CITY XO may not receive or store complete payment-card information.

08PAYMENT INFORMATION

CITY XO may support payment methods including:

• UPI;
• credit cards;
• debit cards;
• net banking;
• wallets; and
• other payment methods.

Payment information may be processed by third-party payment providers.

Where appropriate, payment credentials are handled directly by the relevant payment provider rather than being stored by CITY XO.

We may retain payment-related information necessary for:

• Transaction records;
• reconciliation;
• refunds;
• settlements;
• fraud prevention;
• accounting;
• legal compliance; and
• customer support.

09MEMBERSHIP INFORMATION

If you purchase a CITY XO Membership, we may collect:

• Membership ID;
• Membership type;
• Membership tier;
• purchase date;
• activation date;
• expiry date;
• renewal information;
• Membership status;
• applicable benefits;
• redemption history;
• usage limits;
• redemption timestamps;
• applicable Merchant/location; and
• related Transaction information.

We may use this information to determine whether a Membership Benefit can be redeemed.

10QR AND REDEMPTION DATA

CITY XO may generate a Membership QR code or other verification mechanism.

When a Membership is verified or a benefit is redeemed, we may record:

• Membership reference;
• benefit used;
• Merchant;
• location;
• date and time;
• verification result;
• redemption status; and
• authorized staff account used for verification.

This information helps prevent:

• duplicate redemptions;
• fraud;
• unauthorized Membership use; and
• abuse of benefit limits.

11EVENT AND BOOKING INFORMATION

If you book or purchase an Event, restaurant reservation, club table, or other experience, we may collect:

• Event;
• date and time;
• number of attendees;
• ticket type;
• booking type;
• table type;
• venue;
• reservation status;
• payment information;
• cancellation information;
• check-in information;
• no-show information; and
• other information necessary to fulfil the booking.

12CREATOR CAMPAIGN INFORMATION

For Creator campaigns, CITY XO may collect:

• campaign;
• Merchant;
• Creator;
• deliverables;
• campaign fee;
• Creator fee;
• CITY XO service fee;
• deadlines;
• content submissions;
• approval status;
• publication status;
• tracking links;
• promo codes;
• clicks;
• conversions;
• campaign performance;
• payment status; and
• campaign communications.

13CREATOR PERFORMANCE INFORMATION

For creators participating in campaigns, CITY XO may process performance metrics including:

• views;
• reach;
• likes;
• comments;
• shares;
• saves;
• clicks; and
• conversions.

These metrics may be used to:

• measure campaign performance;
• calculate campaign results;
• report results to Merchants;
• improve Creator matching;
• determine future campaign opportunities; and
• maintain Creator Network records.

14LOCATION INFORMATION

Depending on the features you use, CITY XO may collect location information that you provide, such as:

• city;
• business location;
• Event location;
• booking location;
• Merchant location.

CITY XO will only request more precise device location information where the relevant feature requires it and the applicable permission or legal basis is available.

You may be able to disable device-level location permissions through your device settings.

15DEVICE AND TECHNICAL INFORMATION

When you access the Platform, we may automatically receive technical information such as:

• IP address;
• browser type;
• operating system;
• device type;
• application version;
• language;
• time zone;
• approximate location derived from technical information;
• pages/screens visited;
• referring pages;
• interaction information;
• error logs;
• session information; and
• security-related information.

This information helps us:

• operate the Platform;
• diagnose technical problems;
• secure accounts;
• prevent fraud;
• improve performance; and
• understand how the Platform is used.

16COOKIES AND SIMILAR TECHNOLOGIES

CITY XO may use:

• cookies;
• local storage;
• pixels;
• SDKs;
• analytics technologies; and
• similar technologies.

These technologies may be used for:

• authentication;
• security;
• remembering preferences;
• analytics;
• performance;
• personalization;
• campaign attribution; and
• marketing, where permitted.

Where required, we will provide appropriate choices or controls for non-essential technologies.

17INFORMATION FROM THIRD PARTIES

We may receive information from third parties such as:

• payment providers;
• authentication providers;
• social-media platforms;
• Merchants;
• Event organizers;
• booking partners;
• Creator campaign partners;
• analytics providers;
• fraud-prevention providers; and
• service providers.

For example, a Creator may authorize CITY XO to access or receive certain information associated with a social-media account for campaign management or verification.

18HOW WE USE PERSONAL DATA

We may use personal data for the following purposes.

Providing Services

To:

• create accounts;
• provide Memberships;
• process purchases;
• facilitate bookings;
• provide Event tickets;
• verify Memberships;
• manage redemptions;
• manage Creator campaigns;
• operate Merchant services; and
• provide customer support.

Platform Operations

To:

• operate the Platform;
• maintain infrastructure;
• troubleshoot problems;
• improve functionality;
• personalize experiences;
• develop new features; and
• maintain internal records.

Payments and Finance

To:

• process payments;
• process refunds;
• calculate commissions;
• reconcile Transactions;
• manage Merchant settlements;
• process Creator payments; and
• maintain financial records.

Security

To:

• detect fraud;
• prevent abuse;
• secure accounts;
• investigate suspicious activity;
• protect the Platform; and
• enforce our Terms.

Analytics

To understand:

• how Users use the Platform;
• which products are popular;
• which businesses generate engagement;
• campaign performance;
• Membership usage;
• customer acquisition; and
• other operational trends.

Communications

To send:

• OTPs;
• account notifications;
• payment confirmations;
• booking confirmations;
• Event reminders;
• Membership notifications;
• campaign communications;
• support communications; and
• other Service-related messages.

Marketing

Where permitted and subject to applicable consent requirements, we may send:

• promotional offers;
• new Membership announcements;
• Event promotions;
• creator opportunities;
• Merchant promotions;
• CITY XO updates; and
• other marketing communications.

19CREATOR NETWORK COMMUNICATIONS

If you apply to the CITY XO Creator Network, we may contact you regarding:

• brand collaborations;
• Events;
• campaigns;
• Creator opportunities;
• content requirements;
• deadlines;
• payments; and
• other Creator Network activities.

The current Creator Application expressly asks applicants to consent to CITY XO contacting them for brand collaborations and Events.

You may opt out of non-essential promotional communications where applicable.

Essential communications concerning an active campaign, payment, account, security issue, or other Service may still be sent.

20PERSONALIZATION

CITY XO may use information such as:

• interests;
• favorites;
• browsing activity;
• Memberships;
• bookings;
• Events;
• purchases;
• redemptions; and
• interactions

to personalize discovery and recommendations.

For example, a User interested in food and Events may receive more relevant restaurant and food-event recommendations.

21CUSTOMER SEGMENTATION

CITY XO may create internal customer segments to improve Services and communications.

Examples may include:

• frequent nightlife customer;
• foodie;
• Event-goer;
• high-value customer;
• new customer;
• VIP customer.

These segments are intended to help CITY XO provide relevant Services and business analytics.

CITY XO will not use segmentation to make decisions that unlawfully discriminate against Users.

22SHARING PERSONAL DATA

CITY XO may share personal data where reasonably necessary to provide Services or comply with applicable law.

Recipients may include:

Merchants

Information necessary to fulfil:

• Memberships;
• bookings;
• Events;
• purchases;
• redemptions; or
• other Services.

Event Organizers

Information necessary to:

• issue tickets;
• manage entry;
• communicate Event information; or
• provide Event services.

Payment Providers

Information necessary to:

• process payments;
• refunds;
• verification; and
• settlement.

Creators

Only information reasonably necessary for a campaign or collaboration.

Service Providers

Such as providers supporting:

• cloud infrastructure;
• communications;
• analytics;
• customer support;
• security;
• payment processing;
• storage;
• software development; and
• other Platform operations.

Professional Advisors

Where necessary, CITY XO may share information with:

• lawyers;
• accountants;
• auditors;
• insurers;
• consultants; and
• other professional advisors.

Government or Legal Authorities

Where required or permitted by applicable law.

23MERCHANT DATA SHARING

When you purchase a Merchant's Membership, make a booking, purchase an Event ticket, or otherwise transact with a Merchant, CITY XO may share relevant information with that Merchant to enable fulfilment.

The Merchant may independently process information according to its own legal obligations and privacy practices.

Users should review any applicable Merchant privacy information where relevant.

24CREATOR DATA SHARING

If you participate in a Creator campaign, CITY XO may share relevant Creator information with the Merchant or campaign partner.

This may include:

• Creator name;
• social profile;
• audience information;
• relevant performance metrics;
• campaign deliverables;
• campaign content; and
• campaign performance.

Private contact or payment information will not be shared merely because a Creator participates in a campaign unless necessary, authorized, or legally required.

25PUBLIC INFORMATION

Certain information may be publicly visible where you choose to make it public or where necessary for a Platform feature.

For example, an approved Creator profile may contain selected information such as:

• creator name;
• city;
• content category;
• social-media profile;
• public social-media information; and
• Creator content.

Private information such as personal phone numbers, private email addresses, payment information, and verification documents will not ordinarily be publicly displayed.

26DATA PROCESSORS AND SERVICE PROVIDERS

CITY XO may use third-party vendors to process personal data on our behalf.

These providers may support:

• hosting;
• cloud infrastructure;
• databases;
• analytics;
• payment processing;
• communications;
• customer support;
• security;
• identity verification;
• document storage;
• notifications; and
• other Platform functionality.

CITY XO will seek to use appropriate contractual and technical safeguards for such processing.

27INTERNATIONAL DATA TRANSFERS

Some CITY XO service providers may process or store information outside India.

Where personal data is transferred outside India, CITY XO will implement the safeguards and comply with restrictions applicable under Indian law and any other applicable law.

The locations of particular service providers may change as our technology infrastructure evolves.

28DATA RETENTION

CITY XO will retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Retention periods may depend on:

• account status;
• Transaction history;
• financial/legal requirements;
• active Memberships;
• campaign obligations;
• dispute resolution;
• fraud prevention;
• security requirements; and
• legal or regulatory requirements.

For example, financial and Transaction records may need to be retained after an account is closed.

29DELETION OF PERSONAL DATA

Where applicable, you may request deletion of personal data.

Deletion may be subject to:

• legal retention requirements;
• financial/accounting obligations;
• ongoing disputes;
• fraud-prevention requirements;
• contractual obligations; or
• other lawful grounds for retention.

Where complete deletion is not possible, CITY XO may retain information required by law or for legitimate operational purposes and restrict its use where appropriate.

30YOUR RIGHTS

Subject to applicable law, you may have rights relating to your personal data, including rights to:

• obtain information about processing;
• access personal data;
• request correction;
• request deletion;
• withdraw consent where processing is based on consent;
• manage certain communication preferences;
• nominate another individual where applicable under law; and
• raise a grievance regarding personal-data processing.

The exact rights and available procedures may depend on applicable law and the stage at which relevant provisions are in force.

India's DPDP framework provides for Data Principal rights and requires mechanisms for exercising rights and withdrawing consent; the 2025 Rules also require clear notice and accessible mechanisms for consent withdrawal and rights requests.

31WITHDRAWAL OF CONSENT

Where CITY XO processes personal data based on consent, you may withdraw consent through the mechanism provided by CITY XO.

Withdrawal of consent should be as easy as giving consent, subject to applicable law.

Withdrawing consent may affect our ability to provide certain Services.

For example, withdrawing consent necessary for a particular campaign or account feature may prevent you from participating in that feature.

Withdrawal does not affect processing that occurred lawfully before withdrawal.

32MARKETING COMMUNICATIONS

You may be able to opt out of marketing communications by:

• using the unsubscribe option in an email;
• changing communication preferences;
• responding through an available opt-out mechanism;
• contacting CITY XO; or
• using other methods provided in the communication.

You may still receive essential communications relating to:

• payments;
• bookings;
• Memberships;
• Events;
• account security;
• active campaigns; or
• other Services.

33CHILDREN AND AGE RESTRICTIONS

CITY XO allows standard consumer accounts from age 16, subject to applicable law and the specific requirements of particular Services.

Certain Events, venues, products, and services may require users to be older.

CITY XO may implement additional age verification where appropriate.

We do not intentionally permit users to misrepresent their age.

If we become aware that personal data has been collected in circumstances requiring a different treatment under applicable law, we may take appropriate steps, including deletion or restriction of processing.

Where applicable law requires verifiable parental consent or other additional protections for children, CITY XO will implement those requirements.

34SECURITY

CITY XO uses reasonable technical and organizational measures designed to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• alteration;
• destruction;
• accidental loss;
• misuse; and
• other security threats.

Security measures may include:

• encryption in transit;
• access controls;
• authentication;
• role-based permissions;
• secure storage;
• monitoring;
• logging;
• backups;
• incident response procedures; and
• security testing.

No Internet-based system can be guaranteed to be completely secure.

35DATA BREACHES

If CITY XO experiences a personal-data breach, we will take steps appropriate to the nature and severity of the incident and comply with applicable legal requirements.

Where notification is legally required, CITY XO will notify relevant authorities and/or affected individuals using the required mechanism.

36ACCOUNT SECURITY

You are responsible for keeping your account credentials and devices secure.

You should notify CITY XO promptly if you believe:

• your account has been compromised;
• unauthorized activity has occurred; or
• your login information has been misused.

37FRAUD PREVENTION

CITY XO may process information to identify and prevent:

• payment fraud;
• fake accounts;
• Membership abuse;
• fraudulent redemptions;
• fake bookings;
• ticket fraud;
• creator metric manipulation;
• fraudulent conversions;
• chargeback abuse; and
• other suspicious activity.

This may involve automated and manual checks.

38ANALYTICS

CITY XO may use analytics technologies to understand Platform usage.

Analytics may help us understand:

• which pages/features are used;
• where users encounter problems;
• which products are popular;
• campaign performance;
• conversion rates; and
• general Platform performance.

Where required, CITY XO will obtain appropriate consent for non-essential analytics technologies.

39ADVERTISING AND CREATOR ATTRIBUTION

CITY XO may measure promotional activity through:

• tracking links;
• promo codes;
• referral links;
• campaign identifiers;
• cookies; and
• similar technologies.

This allows CITY XO to associate certain Transactions with Creator campaigns.

For example:

Creator → Campaign → Tracking Link/Code → Customer → Transaction

This information may be used to calculate campaign performance and Creator compensation.

40AI AND AUTOMATED SYSTEMS

CITY XO may in the future use automated systems or AI for:

• recommendations;
• content organization;
• fraud detection;
• customer segmentation;
• Creator matching;
• campaign analysis;
• customer support; and
• operational analytics.

Where automated processing has legal implications for individuals, CITY XO will implement safeguards required by applicable law.

41COMMUNITY FEATURES

CITY XO may introduce community features in the future.

Community features may involve:

• posts;
• comments;
• profiles;
• reactions;
• discussions;
• community memberships;
• Events; and
• other social interactions.

Information that you choose to publish in a community may be visible to other users.

Do not post information that you do not want other users to see.

Community content may be moderated according to CITY XO's Community Guidelines.

42BUSINESS ANALYTICS

CITY XO may provide Merchants with analytics relating to their business.

Depending on the Service, analytics may include:

• Membership sales;
• bookings;
• Event transactions;
• customer acquisition;
• repeat customers;
• campaign performance;
• aggregated customer trends; and
• other business metrics.

Where possible and appropriate, CITY XO may provide aggregated or de-identified information rather than directly identifying individual customers.

CITY XO will not provide a Merchant unrestricted access to personal data merely because that Merchant uses CITY XO.

43AGGREGATED AND DE-IDENTIFIED DATA

CITY XO may create aggregated, statistical, or de-identified information from Platform data.

This information may be used for:

• analytics;
• product development;
• business insights;
• research;
• reporting;
• operational planning; and
• improving CITY XO.

CITY XO will take reasonable measures to prevent such information from being used to identify an individual where it is intended to be de-identified.

44SOCIAL MEDIA

If you connect a social-media account or provide a social-media profile to CITY XO, we may process information available through that account or profile for purposes such as:

• Creator verification;
• campaign matching;
• campaign management;
• performance measurement; and
• attribution.

The social-media platform's own terms and privacy policy also apply.

CITY XO does not control the privacy practices of third-party social-media platforms.

45THIRD-PARTY WEBSITES

The Platform may contain links to third-party websites.

CITY XO is not responsible for the privacy practices of third-party websites.

You should review their respective privacy policies before providing personal information.

46MERCHANT AND CREATOR RESPONSIBILITIES

Merchants and Creators may receive limited personal information necessary to provide CITY XO Services.

They must use that information only for appropriate purposes and comply with applicable privacy obligations.

Merchants and Creators must not:

• sell customer information obtained through CITY XO;
• use CITY XO customer information for unrelated marketing without appropriate permission;
• disclose personal information unnecessarily;
• misuse contact information; or
• retain personal information longer than reasonably necessary.

47LEGAL AND REGULATORY DISCLOSURES

CITY XO may disclose personal data where reasonably necessary to:

• comply with applicable law;
• respond to lawful government requests;
• protect the rights or safety of Users;
• investigate fraud;
• enforce agreements;
• protect CITY XO systems; or
• establish, exercise, or defend legal claims.

48BUSINESS TRANSFERS

If CITY XO is involved in:

• a merger;
• acquisition;
• restructuring;
• financing;
• sale of assets;
• business transfer; or
• similar transaction,

personal data may be transferred as part of the transaction, subject to applicable law and appropriate safeguards.

49DATA PROTECTION CONTACT

For privacy-related questions or requests, contact:

Privacy/Data Protection Contact

[NAME / ROLE]

Email: [privacy@cityxo.com]

Address: [●]

50GRIEVANCE REDRESSAL

If you have a complaint regarding CITY XO's handling of personal data, you may contact:

Grievance Officer: [●]

Email: [●]

Phone: [●]

Address: [●]

We will handle grievances in accordance with applicable law and our internal grievance process.

Where applicable law provides a right to escalate a matter to the relevant data-protection authority or Board, you may exercise that right.

51CHANGES TO THIS PRIVACY POLICY

CITY XO may update this Privacy Policy from time to time.

When we make changes, we will update the "Last Updated" date.

Where required by law, we will provide additional notice or obtain consent.

We encourage you to review this Privacy Policy periodically.

52CONTACT US

For general privacy questions:

CITY XO

SQ7 COMMUNICATIONS PRIVATE LIMITED

Website: cityxo.com

Email: [privacy@cityxo.com]

Registered Office: [●]

53SUMMARY OF YOUR INFORMATION

For convenience, the following summarizes the principal categories of information CITY XO may process:

54EFFECTIVE DATE

Effective Date: 03/10/2026

Last Updated: 03/10/2026

This Privacy Policy is intended to apply to the CITY XO Platform and Services from the Effective Date stated above.