Privacy Policy

1. Introduction

In our mission to make commerce better for everyone at Burbn, we collect and use information about you, our:

• Merchants using Burbn to power your business
• Customers who shop at a Burbn-powered business
• Partners who develop apps for merchants to use, build stores on behalf of merchants, refer potential entrepreneurs to Burbn, or otherwise help merchants operate or improve their Burbn-powered business
• Visitors to Burbn's websites, or anyone contacting Burbn support

This Privacy Policy will help you better understand how we collect, use, and share your personal information. If we change our privacy practices, we may update this privacy policy. If any changes are significant, we will let you know (for example, through the Burbn admin or by email).

2. Our Values

Trust is the foundation of the Burbn platform and includes trusting us to do the right thing with your information. Three main values guide us as we develop our products and services. These values should help you better understand how we think about your information and privacy.

2.1 Your Information Belongs to You

We carefully analyze what types of information we need to provide our services, and we try to limit the information we collect to only what we really need. Where possible, we delete or anonymize this information when we no longer need it. When building and improving our products, our engineers work closely with our privacy and security teams to build with privacy in mind. In all of this work our guiding principle is that your information belongs to you, and we aim to only use your information to your benefit.

2.2 We Protect Your Information from Others

If a third party requests your personal information, we will refuse to share it unless you give us permission or we are legally required. When we are legally required to share your personal information, we will tell you in advance, unless we are legally forbidden.

2.3 We Help Merchants and Partners Meet Their Privacy Obligations

Many of the merchants and partners using Burbn do not have the benefit of a dedicated privacy team, and it is important to us to help them meet their privacy obligations. To do this, we try to build our products and services so they can easily be used in a privacy-friendly way. We also provide detailed FAQs and documentation covering the most important privacy topics, and respond to privacy-related questions we receive.

3. Why We Process Your Information

We generally process your information when we need to do so to fulfill a contractual obligation (for example, to process your subscription payments to use the Burbn platform), or where we or someone we work with needs to use your personal information for a reason related to their business (for example, to provide you with a service). Laws in the European Economic Area ("EEA") and in the United Kingdom ("UK") call these reasons "legitimate interests." These "legitimate interests" include:

• Preventing risk and fraud
• Answering questions or providing other types of support
• Helping merchants find and use apps through our app store
• Providing and improving our products and services
• Providing reporting and analytics
• Testing out features or additional services
• Assisting with marketing, advertising, or other communications

We only process personal information for these "legitimate interests" after considering the potential risks to your privacy and balancing any risks with certain measures—for example, by providing clear transparency into our privacy practices, offering you control over your personal information where appropriate, limiting the information we keep, limiting what we do with your information, who we send your information to, how long we keep your information, or the technical measures we use to protect your information.

We may also process your personal information where you have provided your consent. In particular, where we cannot rely on an alternative legal basis for processing, where you direct us to transfer information to a third party, where we receive your data from a third party is sourced and it already comes with consent or where we are required by law to ask for your consent (including in the context of some of our sales and marketing activities). At any time, you have a right to withdraw your consent by changing your communication choices, opting out from our communications or by contacting us.

4. Your Rights Over Your Information

We believe you should be able to access and control your personal information no matter where you live. Depending on how you use Burbn, you may have the right to request access to, correct, amend, delete, port to another service provider, restrict, or object to certain uses of your personal information. We will not charge you more or provide you with a different level of service if you exercise any of these rights. Please note that a number of these rights apply only in certain circumstances, and all of these rights may be limited by law.

Where Burbn acts as processor or service provider of your personal data on behalf of Burbn merchants, you need to directly contact the merchant you interacted with. For more information about how merchants collect and use your data when you visit and make purchases in their stores, review the specific Merchant's terms and privacy policy. In some cases, we may offer tools and assistance to merchants to help fulfill these requests.

If you are not happy with our response to a request, you can contact us to resolve the issue. If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection or privacy authority at any time.

5. Where We Send Your Information

We are an Indian company, but we work with and process data about individuals across the world. To operate our business, we may send your personal information outside of your state, province, or country, including to the United States. This data may be subject to the laws of the countries where we send it. We take steps to protect your information when we send your information across borders.

5.1 Transfers Outside of Europe and Switzerland

If you are located in the EEA, the UK, or Switzerland, your personal information may be received by our affiliates. Your information is then sent to other Burbn locations and to service providers who may be located in other regions. When we send your personal information outside of the EEA, UK or Switzerland, we do so in accordance with applicable law.

While we do what we can to protect your information, we may at times be legally required to disclose your personal information (for example, if we receive a valid court order).

6. How Long We Retain Your Information

We will retain your personal data only for as long as necessary to fulfill the purposes for which we have collected it. To determine the appropriate retention period, we consider the amount, nature and sensitivity of your personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal requirements.

We will also retain and use your personal information to the extent necessary to comply with our legal obligations, resolve disputes and enforce our policies. If you stop using our services or if you delete your account with us, we will delete your information or store your information in an aggregated and anonymized format.

7. Our Use of Machine Learning

One of the ways in which we are able to help merchants using Burbn is by using techniques like "machine learning" (some laws, including certain EEA and UK laws, may refer to this as "automated decision-making") to help us improve our services. When we use machine learning, we either: (1) still have a human being involved in the process (and so are not fully automated); or (2) use machine learning in ways that don't have legal or similarly significant effects (for example, reordering how apps might appear when you visit the app store).

8. How We Protect Your Information

Our teams work tirelessly to protect your information, and to ensure the security and integrity of our platform. We also have independent auditors assess the security of our data storage and systems that process financial information. However, we all know that no method of transmission over the Internet, and method of electronic storage, can be 100% secure. This means we cannot guarantee the absolute security of your personal information.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website and when providing our services. For more information about how we use these technologies, including a list of other companies that place cookies on our sites, a list of cookies that we place when we power a merchant's store, and an explanation of how you can opt out of certain types of cookies, please see our Cookie Policy.

10. How You Can Reach Us

If you would like to ask a question, make a request, or raise a complaint regarding how Burbn processes your personal information, you may contact us using the details below.

If you are seeking information about how a seller, merchant, or creator on Burbn processes your personal information, please contact that seller or review their individual privacy policy, as Burbn acts as a platform and intermediary.

If you are located in India, your personal information is collected, processed, and controlled by:

Legal & Law Enforcement Requests

If you wish to submit a legally binding request for disclosure of personal information (for example, pursuant to a court order, subpoena, or request from a lawful government authority), such requests must be submitted in writing to the address or email above and must comply with applicable Indian laws.

Burbn will evaluate all such requests in accordance with:

• The Information Technology Act, 2000
• The Digital Personal Data Protection Act, 2023
• Applicable rules and lawful government directions

Response Timeline: We aim to acknowledge and respond to privacy-related queries or grievances within a reasonable timeframe, and no later than the timelines prescribed under applicable Indian law.

11. United States Regional Privacy Notice

This United States Regional Privacy Notice ("US Notice") supplements our Privacy Policy.

This US Notice is for individuals residing in certain US states and is designed to help you better understand how we collect, use, and disclose your personal information and, depending on how you use Burbn and where you reside, how to exercise available rights under various applicable privacy laws in the US, such as the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act (collectively, the "US Privacy Laws").

What Information We Collect and Share

To provide our apps and services to you, we must process information about you, including personal information. We do not "sell" your personal information as that term is defined under US Privacy Laws.

Here is a summary of the categories of personal information we may collect:

• Identifiers, including name, email address, mailing address, phone number
• Personal information categories listed in customer records, including billing address, credit or debit card information
• Commercial information, including products you purchase, place in your cart, favorite or review
• Photos and videos, which may include face imagery, if you choose to provide them
• Internet or other electronic network activity information, including device and browser information, IP address
• Geolocation data, including your mailing and billing address
• Inferences, or information derived from other personal information about you

Your Rights Under US Privacy Laws

Depending on where you live, how you use Burbn, and subject to certain exceptions, you may have some or all of the following rights:

• Right to Know: The right to request that we disclose to you the personal information we collect, use, or disclose about you, and information about our data practices.
• Right to Request Correction: The right to request that we correct inaccurate personal information that we maintain about you.
• Right to Request Deletion: The right to request that we delete personal information that we have collected about you.
• Right to Object to Processing: You can exercise your right to object to certain types of processing activities, subject to applicable law.

To exercise your rights, including the "right to know" and "right to delete," please submit a request through our online portal or contact us directly.

Please note that to protect your information and the integrity of our products and services, we may need to verify your identity before processing your request. In some cases we may need to collect additional information to verify your identity, such as your email address or a government issued ID.

We will not discriminate against you for exercising any of these rights.

12. India: Data Fiduciary Identity and Scope

For the purposes of the Digital Personal Data Protection Act, 2023, Burbn is the Data Fiduciary in respect of personal data it processes for its own purposes, and you are a Data Principal. For the purposes of the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Burbn is an intermediary. For the purposes of the Consumer Protection (E-Commerce) Rules, 2020, Burbn is a marketplace e-commerce entity.

Where Burbn processes personal data on the instructions of a seller — for example where a seller receives a buyer's delivery details in order to fulfil an order — the seller is a separate Data Fiduciary for its own subsequent processing, and Burbn is not responsible for it. Requests concerning a seller's own processing should be addressed to that seller. Burbn imposes contractual restrictions on sellers limiting use of buyer data to order fulfilment, and will act on evidence of misuse.

Where both a named address and a role address are given above, either may be used. The role address is monitored irrespective of who currently holds the role, so that the acknowledgement and disposal timelines below continue to run across staff changes.

13. Categories of Personal Data We Process

This Section states, feature by feature, what Burbn actually processes. It is authoritative and supersedes any more general description earlier in this Policy.

What we do not do. We do not sell personal data. We do not use the positional information generated by AR camera effects to identify you, to estimate your age, or for advertising. We do not build a biometric template for recognising you across sessions or content. We do not transmit your raw contact list off your device. We do not require you to grant camera, microphone, contacts, or location permission in order to use the Platform generally.

14. Purposes and Lawful Basis

Under the Digital Personal Data Protection Act, 2023, personal data may be processed for a lawful purpose either with consent or for a legitimate use specified in the Act. We rely on the following:

• Consent — for optional features and processing that is not necessary to deliver a service you have asked for: contacts-based friend discovery, precise location, AR camera effects, optional cookie categories, promotional communications, and personalisation beyond what is needed to operate the feed safely.
• Voluntary provision for a specified purpose — where you give us data for a purpose you have identified and have not indicated that you object to its use for that purpose, such as an address supplied to receive a delivery.
• Performance of a service you requested — creating and securing your account, processing an order, effecting a payment or refund, delivering goods, operating the wallet, calculating and paying creator earnings, and providing support.
• Compliance with law — tax collection and deduction at source, invoicing and record retention, responses to lawful requests, grievance records, and obligations under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• Prevention and detection of fraud, abuse, and safety risk — including detection of fake engagement, counterfeit listings, payment fraud, coordinated manipulation, and content that endangers users, and enforcement of the Community Guidelines.
• Establishing, exercising, or defending legal claims — including preservation of evidence where a dispute is reasonably anticipated.

We do not process personal data for a purpose incompatible with the purpose for which it was collected without either fresh consent or another lawful basis. We do not condition access to the Platform on consent to processing that is not necessary for it.

15. Notice, Consent, and Withdrawal

Where we rely on consent, we ask for it before processing begins, in clear and plain language, and we tell you what data is involved, why, and how to withdraw. Consent requests are itemised rather than bundled, and refusing one does not affect the others.

• Availability of this notice in other languages. On request we will provide the substance of this Policy in English, Hindi, or another language specified in the Eighth Schedule to the Constitution, as required by the Digital Personal Data Protection Act, 2023.
• How to withdraw. Through in-app privacy settings, by revoking a device permission in your operating system, through the cookie preference centre, by using the unsubscribe control in any promotional message, or by writing to privacy@scrolling.in. Withdrawal is as easy as giving consent.
• Effect of withdrawal. We stop the affected processing within a reasonable period and cease sharing for that purpose. Withdrawal operates prospectively and does not make earlier lawful processing unlawful. The feature that depended on the consent will stop working, which is a consequence of withdrawal and not a penalty for it.
• What survives withdrawal. Processing required by law, needed to complete a transaction already in progress, or necessary to establish, exercise, or defend a legal claim may continue for as long as the law requires or permits.

16. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023 you have the following rights, exercisable free of charge through in-app privacy settings or by writing to privacy@scrolling.in:

1. Right to access information. A summary of the personal data we process about you, the processing activities undertaken, and the identities of other fiduciaries and processors with whom it has been shared, together with a description of what was shared.
2. Right to correction, completion, updating, and erasure. We will correct inaccurate or misleading data, complete incomplete data, update data, and erase data that is no longer necessary for the purpose for which it was collected, unless retention is required by law.
3. Right to grievance redressal. A readily available means of registering a grievance, with the timelines stated in the grievance clause in the Standard Legal Terms below. You may exercise this right before approaching the Data Protection Board.
4. Right to nominate. You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
5. Right to withdraw consent as described in Section 15.

Verification and timelines. We may need to verify your identity before acting, and will not use information supplied for verification for any other purpose. We aim to respond substantively within thirty days. Where a request is complex or numerous, we will tell you and explain the extension. We will not refuse a request without giving reasons.

Your duties. the Digital Personal Data Protection Act, 2023 also places duties on Data Principals. You must not impersonate another person when providing data, must not suppress material information when providing data for a document or identifier issued by the State, must not register a false or frivolous grievance or complaint, and must furnish only information that is verifiably authentic when exercising the right to correction or erasure.

Escalation. If you are not satisfied with our response you may complain to the Data Protection Board of India. Nothing in this Policy or in the arbitration provision of the Terms of Service prevents you from doing so.

17. Children and Persons with a Guardian

Section 9 of the Digital Personal Data Protection Act, 2023 imposes specific obligations in respect of a child, meaning a person who has not completed eighteen years of age, and in respect of a person with a disability who has a lawful guardian.

• Burbn requires users to meet the age requirements stated in the Terms of Service. We do not knowingly process a child's personal data without verifiable consent of a parent or lawful guardian where such consent is required.
• We do not undertake tracking or behavioural monitoring of a child, and do not serve targeted advertising to a user we know to be a child.
• We do not undertake processing of a child's personal data that is likely to cause any detrimental effect on the well-being of the child.
• Where we become aware that an account belongs to a child in circumstances where consent was required and not obtained, we will suspend the processing, and will delete the data unless retention is required by law.
• A parent or lawful guardian may exercise all of the rights in Section 16 on behalf of a child or a person with a disability, by writing to privacy@scrolling.in. We may require evidence of the guardianship relationship.
• Additional protections applicable to AR camera effects for users in the United States who are under thirteen are set out in the Camera Effects and AR Lenses notice.

Reports of content that sexualises or endangers a minor are treated with the highest priority under the Community Guidelines, and relevant information is preserved and reported to law enforcement as required by law, including under the Protection of Children from Sexual Offences Act, 2012.

18. Retention Schedule

We retain personal data only for as long as necessary for the purpose for which it was collected, or for such longer period as the law requires. The following are our standard periods. Where a legal obligation or an active dispute requires longer retention, the longer period applies and we retain only what is necessary for that purpose.

On erasure we delete or irreversibly anonymise the data. Anonymised and aggregated data that cannot be linked back to an identifiable individual is not personal data and may be retained. Data in encrypted backups is overwritten in the ordinary backup rotation cycle rather than extracted individually, and remains subject to the same access controls until it is.

19. Security and Breach Notification

We implement reasonable security safeguards to prevent a personal data breach, as required by the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encryption of data in transit and at rest where appropriate, access control on a need-to-know basis, authentication and session controls, logging and monitoring, secure development practices, vendor due diligence, and periodic review.

No system can be guaranteed absolutely secure. We do not represent that the Platform is impenetrable, and this Policy should not be read as a warranty of security. What we do commit to is the following, in the event of a personal data breach:

• Notification to the Board and to you. We will give notice of a personal data breach to the Data Protection Board of India and to each affected Data Principal, in the form and within the time prescribed under the Digital Personal Data Protection Act, 2023.
• Reporting to CERT-In. We will report reportable cyber security incidents to the Indian Computer Emergency Response Team within six hours of noticing or being notified of the incident, as required by the directions issued by the Indian Computer Emergency Response Team (CERT-In) dated 28 April 2022.
• Content of notice. A description of the breach, its likely consequences, the measures taken to mitigate risk, the measures you can take to protect yourself, and contact details for further information.
• Records. We maintain records of breaches, our assessment, and remedial action, and retain logs for at least 180 days as required.

You are responsible for keeping your credentials confidential and for using a unique password. Notify us immediately at support@scrolling.in if you believe your account has been compromised. Report a suspected vulnerability to privacy@scrolling.in; we will not pursue action against a researcher who reports a vulnerability in good faith, without exploiting it beyond what is necessary to demonstrate it and without accessing or exfiltrating other users' data.

20. Processors, Transfers, and Automated Processing

20.1 Data Processors and Recipients

We engage processors under written contract, which restricts them to processing on our instructions, imposes confidentiality and security obligations, prohibits onward transfer without authorisation, and requires deletion or return on termination. Categories of recipient are:

• cloud hosting, storage, content delivery, and edge security providers;
• payment gateways, payout partners, and wallet and escrow providers;
• logistics and last-mile delivery partners, which receive delivery details only;
• sellers, which receive the details necessary to fulfil an order;
• communication providers for transactional messages, notifications, and email;
• analytics, crash reporting, and error monitoring providers;
• identity verification, KYC, and fraud prevention providers;
• the Information Technology Act, 2000 intermediary technology providers, including the augmented reality camera technology provider identified in the Camera Effects notice;
• professional advisers, auditors, and insurers, under duties of confidence; and
• law enforcement, regulators, and courts, where disclosure is required by law or by a valid order.

In a merger, reorganisation, financing, or sale of business or assets, personal data may be transferred as part of that transaction, subject to the recipient being bound to honour this Policy in respect of it. We will notify you of any such transfer that materially affects how your data is handled.

20.2 Requests from Authorities

We disclose personal data to a government agency or law enforcement body only where legally obliged to do so, and we require that a request be in writing, identify the requesting authority and the legal basis, and be proportionate to a lawful purpose. We will decline or seek narrowing of a request that is overbroad, vague, or unlawful. Where we are not legally prohibited from doing so, we will notify the affected user before disclosure, or as soon as the prohibition lapses.

20.3 Transfers Outside India

Some of our providers process data outside India. the Digital Personal Data Protection Act, 2023 permits transfer of personal data outside India except to a country or territory notified as restricted by the Central Government. We do not transfer personal data to any such notified country or territory, and where a notification is issued we will adjust our arrangements to comply. Transfers are made under contractual protections, and sector-specific requirements to store certain payment data in India are complied with by the relevant regulated providers.

20.4 Automated Processing and Recommendations

We use automated systems to rank the feed, generate recommendations, order search results, classify content, validate creator views, and detect fraud and abuse. These systems are probabilistic and are described further in Section 7 above. We do not use solely automated processing to make a decision about you that has a legal effect or a similarly significant effect without a route to human review. Where an automated decision restricts your account, withholds a payout, removes content, or invalidates creator earnings, you may seek human review through the appeal or grievance channels, and the grievance timelines in the Standard Legal Terms below apply.

We do not use special categories of data to train models for advertising, and we do not use the positional data generated by AR camera effects for any purpose other than rendering the effect.

21. Order of Precedence

Which means: If two Burbn documents disagree, this list decides which one wins, so the answer is the same no matter which document you read first.

this Policy forms part of a single set of contractual documents governing use of the Burbn platform. Where a conflict or inconsistency arises between this Policy and any other document in that set, the conflict shall be resolved by applying the following order of precedence, in descending order of authority:

1. any separately signed written agreement between Burbn and the relevant party, but only for the programme it covers and only to the extent of the conflict
2. the Terms of Service
3. the Merchant Agreement, for matters concerning sellers
4. the Creator Policy, for matters concerning creators
5. the Privacy Policy and the Camera Effects and AR Lenses notice, for matters concerning personal data
6. the Community Guidelines and Content Policy
7. the Returns, Exchange and Refunds Policy, the Burbn Money Back Guarantee, the Shipping and Delivery Policy, and the Cookie Policy
8. any other notice, help-centre article, dashboard text, or in-product copy

A document lower in this order does not narrow, qualify, or waive a right or obligation created by a document higher in it. Where a document lower in the order is silent on a matter addressed by a higher document, the higher document applies. Headings, summaries, and any explanatory text introduced by the words "Which means" are provided for readability only, do not form part of the operative terms, and do not limit the provisions they accompany.

No statement made in help-centre articles, dashboard copy, in-product text, marketing material, or by any employee or agent orally shall vary this Policy unless recorded in a written amendment published under the modification provisions of the Terms of Service.

22. Platform Role and Intermediary Status

Which means: Burbn runs the marketplace and the app. It does not manufacture, own, or sell the products listed on it, and it does not author the content users post.

Burbn operates as an intermediary within the meaning of the Information Technology Act, 2000 and as a marketplace e-commerce entity within the meaning of the Consumer Protection (E-Commerce) Rules, 2020. Burbn provides a technology platform that enables independent third-party sellers to list and sell goods, and enables users to publish content, communicate, and transact.

1. Burbn does not manufacture, import, stock, own, inspect, or take title to any product listed on the platform, except where a listing expressly and prominently identifies Burbn as the seller of record. The contract of sale for every other listing is formed directly and exclusively between the buyer and the relevant seller.
2. Burbn does not originate, select, author, commission, or modify user content, and does not exercise editorial control over it. Any moderation, ranking, recommendation, labelling, removal, or restriction undertaken by Burbn is performed voluntarily and in good faith to protect users and to comply with law, and shall not be construed as adoption of, endorsement of, or responsibility for that content, nor as conduct displacing the protection conferred by Section 79 of the Information Technology Act, 2000.
3. Burbn observes the due diligence obligations applicable to intermediaries under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, including publication of these documents, operation of a grievance mechanism, and removal or disabling of access to unlawful information on receipt of actual knowledge in the form of a court order or a notification by an appropriate government agency.
4. Nothing in this Policy creates any agency, partnership, joint venture, employment, franchise, or fiduciary relationship between Burbn and any seller, creator, logistics provider, payment provider, or user. No party may hold itself out as having authority to bind Burbn.
5. Where Burbn assists a user in a dispute with a seller, processes a refund, arranges a pickup, or applies a service standard against a seller, it does so as an administrative facility for the orderly operation of the marketplace. Such assistance does not constitute an assumption of the seller's obligations, an admission of liability, or a warranty by Burbn in respect of the goods.

23. Disclaimer of Warranties

Which means: The platform is provided as it is. Burbn does not promise it will be uninterrupted, error-free, or fit for a particular purpose you have in mind.

Without limiting the generality of the foregoing, Burbn does not warrant that:

• the platform will be uninterrupted, timely, secure, or free from error, defect, or vulnerability;
• any defect, interruption, or vulnerability will be corrected within any particular period;
• the platform, or any server or infrastructure through which it is delivered, is free of malicious code;
• any result, outcome, reach, impression count, conversion, ranking, payout, revenue, saving, or commercial benefit will be achieved;
• any estimate, forecast, projection, delivery timeline, availability indication, price comparison, or analytics figure displayed on the platform is accurate, complete, or current;
• any content, listing, review, rating, claim, or representation published by a seller, creator, or other user is accurate, lawful, or reliable; or
• any third-party service, integration, logistics provider, payment provider, or technology provider will remain available or will perform as described.

Statistical, algorithmic, and machine-learning outputs — including recommendation ranking, search results, fraud signals, view validation, and content classification — are inherently probabilistic. They are provided as operational tools and not as statements of fact, and no warranty is given as to their accuracy in any individual case.

Nothing in this clause excludes or restricts any warranty, condition, guarantee, or right that cannot lawfully be excluded or restricted, including under the Consumer Protection Act, 2019. See the clause titled "Preservation of Statutory Rights" below.

24. Limitation of Liability

Which means: There is a ceiling on what Burbn can be made to pay, and Burbn is not liable for indirect losses such as lost profits. Some liabilities cannot be limited by law and are not limited here.

24.1 Exclusion of Indirect Loss

To the maximum extent permitted by applicable law, Burbn and its affiliates, directors, officers, employees, agents, licensors, vendors, and third party service providers shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive loss or damage, nor for any loss of profit, loss of revenue, loss of anticipated saving, loss of business, loss of goodwill or reputation, loss of opportunity, loss of data, or cost of procuring substitute services, howsoever arising and whether in contract, tort including negligence, breach of statutory duty, restitution, or otherwise, and whether or not Burbn was advised of the possibility of such loss.

24.2 Aggregate Financial Cap

Subject to clause 24.4, the total aggregate liability of Burbn arising out of or in connection with this Policy, whether in contract, tort, breach of statutory duty, or otherwise, and whether in respect of one claim or a series of related claims, shall not exceed the greater of:

1. the total amounts actually paid to Burbn by, or paid out by Burbn to, you under this Policy in the 3 calendar months immediately preceding the first event giving rise to the claim; and
2. INR 5,000 (Rupees Five Thousand).

The monetary floor at sub-clause (2) applies so that the cap can never evaluate to nil. A cap capable of evaluating to nil operates as an exclusion of liability rather than a limitation of it, and is accordingly stated here as a floor so that the clause remains a genuine limitation.

24.3 Matters Outside Burbn's Control

Burbn shall not be liable for loss or damage arising from:

• any defect in, safety of, description of, quality of, legality of, or non-conformity of any product supplied by a seller;
• any act, omission, delay, misconduct, insolvency, or breach by a seller, creator, buyer, logistics provider, payment provider, technology provider, or other third party;
• any content published by a user, including any reliance placed on it;
• loss, theft, damage, misdelivery, or delay occurring in transit;
• any unauthorised access to an account arising from a failure by the account holder to keep credentials secure;
• any suspension, restriction, or removal of content, listings, features, or accounts undertaken in accordance with these documents;
• any interruption, degradation, or unavailability of the platform, including during scheduled or emergency maintenance; or
• any event falling within the clause titled "Force Majeure" below.

24.4 Liabilities That Are Not Limited

Nothing in this Policy shall exclude or limit the liability of either party for:

• death or personal injury caused by that party’s negligence;
• fraud or fraudulent misrepresentation;
• wilful misconduct or gross negligence;
• any liability that cannot lawfully be excluded or limited under applicable law; or
• in the case of a seller or creator, the indemnity obligations owed to Burbn.

24.5 Basis of the Bargain and Allocation of Risk

Each party acknowledges that the exclusions and limitations in this clause are a reasonable and negotiated allocation of commercial risk, that they are reflected in the fees and commercial terms applicable between the parties, and that Burbn would not make the platform available on the same terms without them. Each sub-clause operates separately. If any sub-clause is held to be unenforceable in whole or in part, the remaining sub-clauses continue to apply.

This clause survives termination or expiry of this Policy and continues to protect Burbn in respect of claims relating to the period before termination.

25. Indemnity

Which means: If Burbn is sued or fined because of something you did, you covers the cost.

You shall indemnify, defend, and hold harmless Burbn, its affiliates, and their respective directors, officers, employees, agents, licensors, vendors, and third party service providers from and against all claims, demands, proceedings, losses, liabilities, damages, fines, penalties, taxes, interest, awards, settlements, and costs, including reasonable legal fees and the internal cost of responding to regulatory or law-enforcement process, arising out of or in connection with:

• any breach of this Policy or of any other document in the Burbn policy set;
• any content, listing, claim, representation, review, advertisement, or communication published or made;
• any product supplied, including its defect, safety, labelling, description, packaging, warranty, or non-conformity;
• any infringement or misappropriation of intellectual property, publicity, privacy, or personality rights;
• any breach of applicable law, regulation, licence condition, or order of a court or authority;
• any misuse of personal data, including any failure to comply with obligations owed as a data fiduciary or data processor;
• any tax, duty, cess, or levy properly attributable to the indemnifying party, including any liability arising from an incorrect declaration of tax status or registration; and
• any act, omission, fraud, negligence, or misconduct of the indemnifying party or of its employees, agents, contractors, or representatives.

Burbn shall notify the indemnifying party of any claim for which indemnity is sought, without undue delay. Burbn may, at its option, assume or participate in the conduct of the defence of such claim using counsel of its choosing, and the indemnifying party shall not settle any claim in a manner that imposes any obligation, admission, or restriction on Burbn without Burbn's prior written consent. A failure or delay in notification does not relieve the indemnifying party except to the extent it is materially prejudiced by that failure.

Burbn may set off any amount due to it under this clause against any amount it holds for or owes to the indemnifying party, including payouts, balances, reserves, rewards, and refunds. This clause survives termination or expiry of this Policy.

26. Grievance Redressal and Statutory Contacts

Which means: There is a named officer whose job is to resolve complaints, with fixed deadlines. Use this route before litigation.

In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection Act, 2019, Burbn has designated the officers below. Complaints may be submitted in writing, in English or Hindi, and should identify the complainant, the content, order, listing, or account concerned, and the nature of the grievance.

26.1 Timelines

• Acknowledgement: within 24 hours of receipt.
• Disposal: within 15 days of receipt, with reasons recorded.
• Removal of non-consensual intimate imagery or content in the nature of impersonation: within 24 hours of a valid complaint.
• Removal or disabling of access to unlawful information on receipt of actual knowledge by way of a court order or notification by an appropriate government agency: within 36 hours.
• Preservation of records for investigation: 180 days, or longer where required by law or by an order.

26.2 Escalation

A complainant dissatisfied with the outcome may escalate to legal@scrolling.in. Nothing in this clause restricts a complainant from approaching a consumer commission, the Grievance Appellate Committee constituted under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Data Protection Board constituted under the Digital Personal Data Protection Act, 2023, or any other competent authority, and a complainant is not required to exhaust this route before doing so where the law provides otherwise.

Complaints that are abusive, repetitive, manifestly unfounded, or made in bad faith may be closed with reasons. Submitting knowingly false information in a grievance, or a false takedown notice, may itself attract liability and may be relied upon by Burbn in proceedings.

27. Governing Law, Arbitration, and Jurisdiction

Which means: Indian law applies. Most disputes go to individual arbitration seated in Noida. The courts at Noida supervise.

this Policy is governed by and shall be construed in accordance with the laws of the Republic of India, without regard to any conflict of laws principle that would apply the law of another jurisdiction. For the avoidance of doubt, no law of any other state, province, territory, or country is intended to govern this Policy.

Any dispute, claim, or controversy arising out of or relating to this Policy, including as to its formation, existence, validity, interpretation, performance, breach, or termination, shall be resolved by final and binding arbitration on an individual basis in accordance with the arbitration provision at Section 17 of the Terms of Service, which is incorporated into this Policy by reference and applies as if set out in full here.

• Governing statute: the Arbitration and Conciliation Act, 1996.
• Seat of arbitration: Noida, Uttar Pradesh, India. The seat fixes the courts having supervisory jurisdiction over the arbitration.
• Venue of hearings: Noida, Uttar Pradesh, India, provided that hearings may be conducted by video conference or on documents alone where the parties agree or the arbitral tribunal so directs, so that participation is not unduly burdensome or expensive.
• Tribunal: a sole arbitrator, appointed by agreement failing which in accordance with the Arbitration and Conciliation Act, 1996.
• Language: English.
• Pre-arbitration step: a written notice of dispute followed by 30 days for good-faith resolution.

27.1 Interim and Urgent Relief

Notwithstanding the pre-arbitration step, either party may at any time apply to a competent court, or to the arbitral tribunal once constituted, for interim, interlocutory, injunctive, or other equitable relief, including to restrain infringement or misappropriation of intellectual property, breach of confidence, unauthorised access to data, or continuing unlawful conduct. Seeking such relief is not a waiver of the agreement to arbitrate and does not require the negotiation period to have elapsed. This preserves Burbn's ability to act immediately against an infringing listing or an ongoing safety risk.

27.2 Residual Jurisdiction

Where a dispute is not subject to arbitration, is excluded from arbitration, or where the agreement to arbitrate is held unenforceable in respect of a particular claim, the competent courts at Noida, Uttar Pradesh, India shall have exclusive jurisdiction over that claim, and each party irrevocably submits to that jurisdiction and waives any objection based on forum or inconvenience.

The United Nations Convention on Contracts for the International Sale of Goods does not apply and is expressly excluded. This clause survives termination or expiry of this Policy.

28. Preservation of Statutory Rights

Which means: Nothing in this document takes away a right the law gives you and does not let you sign away.

Nothing in this Policy operates to exclude, restrict, modify, or waive any right, remedy, guarantee, warranty, or protection conferred on a person by applicable law which cannot lawfully be excluded, restricted, modified, or waived, including under the Consumer Protection Act, 2019, the Consumer Protection (E-Commerce) Rules, 2020, the Digital Personal Data Protection Act, 2023, and the Indian Contract Act, 1872.

Where any provision of this Policy would, but for this clause, have that effect, the provision applies only to the extent permitted by law and is otherwise to be read down, or if it cannot be read down, severed, without affecting the remainder. In particular, a consumer's statutory right to seek redress before a consumer commission, and a data principal's right to approach the Data Protection Board, are preserved in full and are not displaced by the arbitration provision.

29. Force Majeure

Which means: Neither side is in breach for a failure caused by an event genuinely outside its control.

Neither party shall be liable for any failure or delay in performing an obligation under this Policy, other than an obligation to pay money already due, to the extent the failure or delay is caused by an event beyond that party's reasonable control, including act of God, flood, fire, earthquake, storm, epidemic or pandemic and any public-health measure taken in response, war, armed conflict, terrorism, riot, civil commotion, strike or other labour disturbance, act or order of any government or regulator, change in law, judicial order, embargo or sanction, failure or interruption of electricity, telecommunications, the internet, or any cloud, hosting, content-delivery, payment, or logistics provider, and any cyber attack, denial-of-service attack, or comparable malicious act.

The affected party shall notify the other without undue delay, shall use reasonable endeavours to mitigate, and shall resume performance as soon as reasonably practicable. Where such an event continues for more than sixty consecutive days, either party may terminate this Policy on written notice, without liability for the termination itself, and without prejudice to amounts already accrued.

30. Notices

Which means: How each side formally contacts the other, and when a notice counts as received.

Notices to Burbn must be in writing and sent to legal@scrolling.in and, where the notice commences or relates to legal proceedings, also by registered post or courier to Burbn, 503, A1 Tower, Sector 73, Noida, Uttar Pradesh, India, marked for the attention of the Legal Department. Grievances under the clause titled "Grievance Redressal and Statutory Contacts" should instead be sent to grievance@scrolling.in.

Notices to you may be given by email to the address registered on the account, by notification within the platform or the seller or creator dashboard, or by post to the address on record. It is the responsibility of the account holder to keep those details accurate and monitored.

A notice is deemed received: if sent by email, at the time of transmission, or if transmitted outside business hours, when business hours next resume; if given in-platform, on display to the recipient; and if sent by registered post or courier, on the third business day after despatch, or on proof of delivery, whichever is earlier. A notice sent to a stale, full, or unmonitored address recorded by the recipient is nonetheless validly given.

31. Electronic Record and Acceptance

Which means: This document is legally binding electronically. No physical signature is needed, and Burbn's records of your acceptance are evidence of it.

this Policy is an electronic record within the meaning of the Information Technology Act, 2000 and the rules made under it, and is a valid and enforceable contract formed by electronic means in accordance with Section 10A of the Information Technology Act, 2000. It does not require a physical or digital signature, seal, or stamp to be binding.

1. Registration for an account, indication of acceptance through any interface element provided for that purpose, or continued access to or use of the platform, each constitutes full and unconditional acceptance of this Policy.
2. Burbn maintains electronic records of acceptance, including identifiers, timestamps, document version, and the interface presented at the time. Each party agrees that such records, and any true copy or system-generated extract of them, are admissible and may be relied upon as evidence of acceptance in any arbitral or judicial proceeding, and waives any objection to admissibility founded solely on their electronic form.
3. The version of this Policy in force at the time of the relevant act or omission governs that act or omission. Burbn retains superseded versions and will make the version applicable to a given date available on request to a party with a legitimate interest in it.

32. General Provisions

Which means: The standard machinery: what survives, what can be transferred, what happens if one clause fails.

32.1 Survival

Termination or expiry of this Policy does not affect any right, obligation, or liability that accrued before it. The clauses concerning intellectual property licences already granted, confidentiality, data protection, disclaimer of warranties, limitation of liability, indemnity, set-off and recovery, grievance redressal, governing law, arbitration and jurisdiction, notices, electronic records, and this clause survive termination and continue to bind both parties. The survival of the limitation of liability clause operates for the benefit of Burbn as well as of you.

32.2 Severability

If any provision of this Policy is held invalid, illegal, or unenforceable by a court, tribunal, or competent authority, that provision shall first be read down to the minimum extent necessary to render it valid and enforceable while preserving the parties' commercial intent. Only if it cannot be read down shall it be severed, and severance shall not affect the validity or enforceability of the remainder.

32.3 No Waiver

A failure or delay in exercising a right under this Policy is not a waiver of that right, and a single or partial exercise does not preclude further exercise. A waiver is effective only if in writing and signed by an authorised representative of the waiving party, and applies only to the instance and purpose for which it is given. Burbn's forbearance in enforcing a provision against one person creates no expectation or entitlement in favour of any other.

32.4 Assignment

You may not assign, transfer, charge, sub-contract, or otherwise deal with any right or obligation under this Policy without Burbn's prior written consent. Burbn may assign or transfer this Policy in whole or in part to an affiliate, or in connection with a merger, reorganisation, or sale of all or part of its business or assets, on notice and without consent. this Policy binds and benefits each party's permitted successors and assigns.

32.5 Third Party Rights

Except as expressly provided, no person who is not a party to this Policy has any right to enforce it. Burbn's affiliates, and the vendors and third party service providers identified as intended third-party beneficiaries in Section 17 of the Terms of Service, may enforce the clauses expressed to be for their benefit, including the disclaimer of warranties, the limitation of liability, the indemnity, and the agreement to arbitrate. No consent from any such person is required to amend or terminate this Policy.

32.6 Entire Agreement

this Policy, together with the other documents in the Burbn policy set and any separately signed agreement, constitutes the entire agreement between the parties on its subject matter and supersedes all prior representations, understandings, and arrangements, whether written or oral. For the avoidance of doubt, and notwithstanding anything to the contrary, this Policy does not exclude, supersede, or disapply any other document in the Burbn policy set; those documents apply together and are reconciled by the clause titled "Order of Precedence". Nothing in this clause limits liability for fraud or fraudulent misrepresentation.

32.7 Set-Off and Recovery

Burbn may set off, withhold, deduct, or recover any amount due to it or reasonably anticipated to become due to it under this Policy — including fees, commissions, penalties, refunds, chargebacks, reversals of incorrectly credited amounts, taxes, and indemnified sums — against any amount it holds for or owes to you, including payouts, wallet balances, reserves, rewards, and incentives. Burbn will identify the basis of any set-off on request. Amounts remaining unrecovered are payable on demand and Burbn may pursue recovery through any lawful means.

32.8 Amendment

Burbn may amend this Policy. Where an amendment materially and adversely affects a party's rights, Burbn will give reasonable advance notice by email, in-platform notification, or publication, other than where an immediate change is required by law, regulatory direction, an order of a court or authority, or to address a security or safety risk, in which case the change takes effect on publication. Continued use after the effective date constitutes acceptance. A party that does not accept an amendment must cease using the platform and, where applicable, close its account before the effective date.

32.9 Language and Interpretation

The English text of this Policy prevails over any translation. The words "including", "includes", and "in particular" are illustrative and do not limit the generality of the words preceding them. A reference to a statute includes any amendment, re-enactment, or subordinate legislation made under it. The singular includes the plural. No rule of construction adverse to the drafter shall be applied by reason only of a document having been prepared by Burbn; each party has had the opportunity to obtain independent legal advice.

32.10 Compliance, Anti-Bribery, and Sanctions

Each party shall comply with all applicable anti-bribery, anti-corruption, anti-money-laundering, counter-terrorist-financing, and economic-sanctions laws, and shall not offer or accept any improper payment or advantage in connection with this Policy. Each party represents that it is not, and is not owned or controlled by, a person subject to applicable sanctions. Breach of this clause is a material breach entitling Burbn to suspend or terminate immediately.