Ventra
Privacy Policy

# Ventra Privacy Policy

\*\*Effective Date:\*\* 7 September 2026

\*\*Last Updated:\*\* 7 September 2026

\*\*Brand:\*\* Ventra

\*\*Legal Operator:\*\* Advisory Mediacare Services

\*\*Business Structure:\*\* Proprietorship

\*\*Registered Office:\*\* Bengaluru, Karnataka, India

\*\*GSTIN:\*\* 29BHGPP4564E3ZO

\*\*Website / Privacy Policy Contact:\*\* support\@creatorcloud.in

\*\*Support Phone:\*\* +91 9738841367

\*\*Grievance Officer:\*\* Tabrez

\*\*Grievance Email:\*\* gpttabrez\@gmail.com

\*\*Grievance Phone:\*\* +91 9738841367

\*\*Governing Law:\*\* Karnataka, India

\*\*Dispute Jurisdiction:\*\* Bengaluru, Karnataka, subject to applicable law

\*\*Minimum User Age:\*\* 18 years

\> \*\*Legal review notice:\*\* This document is a detailed operational privacy-policy draft prepared from the current Ventra application/backend audit and the business information supplied by the operator. It is not legal advice. Before publishing it as the official privacy policy or submitting its URL to Google Play, the operator should have the final version reviewed by a qualified lawyer familiar with Indian privacy, consumer, e-commerce, tax and platform requirements.

## 1. Introduction

Advisory Mediacare Services, operating under the brand name \*\*Ventra\*\* ("Ventra", "we", "us", "our"), provides a technology platform through which customers can access participating businesses, delivery services, parcel delivery and related service-booking functionality.

This Privacy Policy explains how Ventra collects, receives, uses, processes, stores, shares, protects and deletes information in connection with:

\- the Ventra customer application;

\- the Ventra Driver application;

\- the Ventra Business application;

\- Ventra's administrative systems;

\- Ventra's backend services and APIs; and

\- related support, payment, delivery, return, refund and dispute workflows.

This policy applies to personal information processed through these services unless a specific service provides a separate privacy notice.

By using Ventra, you acknowledge that information may be processed as described in this Privacy Policy, subject to applicable law and your rights under applicable law.

# 2. Who Operates Ventra

Ventra is operated by:

\*\*Advisory Mediacare Services\*\*

\*\*Business structure:\*\* Proprietorship

\*\*Brand:\*\* Ventra

\*\*Registered office:\*\* Bengaluru, Karnataka, India

\*\*GSTIN:\*\* 29BHGPP4564E3ZO

For privacy questions, data requests, complaints or grievances:

\*\*Email:\*\* support\@creatorcloud.in

\*\*Phone:\*\* +91 9738841367

For formal grievances:

\*\*Grievance Officer:\*\* Tabrez

\*\*Email:\*\* gpttabrez\@gmail.com

\*\*Phone:\*\* +91 9738841367

# 3. Eligibility

Ventra is intended for users who are \*\*18 years of age or older\*\*.

Ventra does not intentionally design its services for children under 18. If we become aware that an account has been created by a person below the applicable minimum age, we may take reasonable steps to restrict or terminate that account and address associated information in accordance with applicable law.

Parents or guardians who believe that a minor has provided personal information to Ventra may contact us through the support or grievance channels.

# 4. Categories of Information We Process

The information Ventra processes depends on the user's role and the features used.

The principal categories are described below.

## 4.1 Account and identity information

Ventra may process:

\- account identifier assigned by our authentication service;

\- email address;

\- telephone/mobile number;

\- display name;

\- profile photograph;

\- authentication information associated with Google authentication service;

\- Google identity information necessary for authentication;

\- account role, such as customer, driver or business;

\- account status;

\- account creation and deletion-request information.

Authentication credentials are processed through the authentication mechanisms used by Ventra and its service providers. Ventra does not intend to collect users' passwords through ordinary application forms where authentication is delegated to the applicable authentication provider.

# 5. Customer Information

When you use the Ventra customer application, we may process information necessary to provide ordering, delivery, parcel and service-booking functionality.

This can include:

\- name;

\- phone number;

\- email;

\- profile photograph;

\- pickup information;

\- drop-off information;

\- current location where permission is granted;

\- delivery addresses;

\- latitude and longitude associated with a transaction;

\- order history;

\- products/items ordered;

\- quantities;

\- prices;

\- delivery category;

\- package weight where applicable;

\- package instructions;

\- sender information;

\- receiver information;

\- delivery OTP information;

\- delivery attempts;

\- proof-of-delivery information;

\- cancellation information;

\- return information;

\- replacement information;

\- dispute information;

\- support cases;

\- ratings and reviews;

\- payment transaction information;

\- refund information;

\- wallet or ledger information where applicable; and

\- notification/device information.

The information may be required to calculate quotes, create orders, communicate with businesses and drivers, coordinate delivery, process payments, investigate disputes and provide support.

# 6. Driver Information

Ventra's Driver application requires additional information because drivers perform delivery and operational services.

Depending on the driver's use of the platform, Ventra may process:

\- name;

\- phone number;

\- email;

\- profile photograph;

\- account identifier assigned by our authentication service;

\- masked or hashed Aadhaar-related information;

\- masked or hashed PAN-related information;

\- driving licence images;

\- vehicle information;

\- vehicle documents;

\- compliance/KYC status;

\- operating zones;

\- service areas;

\- driver availability;

\- online/offline status;

\- current GPS location;

\- delivery assignment information;

\- pickup and delivery information;

\- proof-of-delivery information;

\- delivery attempts;

\- cancellation information;

\- earnings;

\- wallet balance;

\- ledger entries;

\- withdrawal requests;

\- payout information;

\- ratings;

\- support cases;

\- dispute information;

\- device model;

\- device manufacturer;

\- operating system;

\- application version; and

\- push-notification token.

### 6.1 Government identity information

Ventra may require driver identity information for KYC and compliance.

The current audited design uses \*\*masked and/or hashed identity information rather than retaining raw government identity numbers as ordinary application data\*\*. Drivers may nevertheless upload document images, such as driving-licence documents, when required for verification.

KYC documents should be accessible only to authorized personnel and systems with a legitimate operational, verification, compliance, security or dispute-related purpose.

# 7. Business Information

Businesses using Ventra may provide and generate information including:

\- business/legal name;

\- GSTIN;

\- PAN-related information;

\- business address;

\- business location;

\- authorized business contact information;

\- KYC information;

\- business KYC documents;

\- products;

\- product descriptions;

\- product images;

\- prices;

\- inventory;

\- service areas;

\- operating zones;

\- dispatch preferences;

\- enabled business/service verticals;

\- order information;

\- customer-related fulfilment information;

\- settlement information;

\- fees and commissions;

\- tax-related records;

\- payout information;

\- ratings and reviews;

\- support cases;

\- dispute information; and

\- account status.

Business information is processed to onboard and verify businesses, provide marketplace functionality, process orders, coordinate delivery, calculate settlements, manage returns/refunds, provide support and maintain financial and operational records.

# 8. Location Information

Location is an important part of Ventra's delivery functionality.

## 8.1 Customer location

The customer application may request device location when required for:

\- identifying the user's current location;

\- selecting pickup or drop-off points;

\- obtaining delivery quotes;

\- creating delivery orders;

\- supporting navigation-related workflows; and

\- providing location-dependent services.

The audited customer implementation uses foreground, one-shot location rather than continuous background location tracking.

If required location permission is denied, certain order or location-dependent features may not work.

## 8.2 Driver location

Driver location is processed differently because continuous operational location is necessary to dispatch and track deliveries.

The Driver application may collect location while the driver is operating the service, including foreground and background location through an Android foreground service where the driver has granted the required permissions.

Driver location may be used for:

\- dispatch matching;

\- driver eligibility;

\- distance calculation;

\- live delivery tracking;

\- customer delivery visibility;

\- administrative dispatch;

\- navigation support;

\- delivery coordination;

\- operational safety; and

\- fraud/security investigation.

The current audited implementation stores the driver's \*\*current operational location\*\* and overwrites it as new location information is received rather than maintaining a historical GPS trail in the current-location field.

Drivers cannot use certain online/offer/acceptance functions without the location permission required for those functions.

## 8.3 Business location

Businesses provide a business/pickup location as part of their profile and operational configuration.

The Business application does not use continuous runtime location tracking according to the current application audit.

## 8.4 Location sharing

Location may be made available to the parties and systems that need it to perform an active delivery or related operational function.

For example, during an active delivery, relevant customer interfaces, dispatch systems and authorized administrators may receive the driver's current operational location.

# 9. Order and Delivery Information

When an order or delivery is created, Ventra may process information necessary to fulfil it.

Depending on the transaction, this can include:

\- order identifier;

\- customer information;

\- business information;

\- driver information;

\- product/item information;

\- item quantity;

\- product price;

\- delivery charge;

\- platform fee;

\- applicable tax;

\- pickup address;

\- drop-off address;

\- coordinates;

\- delivery category;

\- package weight;

\- sender name and phone;

\- receiver name and phone;

\- package instructions;

\- consignment information;

\- delivery OTP;

\- delivery attempts;

\- proof of delivery;

\- return-to-business information;

\- cancellation information;

\- dispute information; and

\- status history required to operate and audit the transaction.

This information enables Ventra to create, dispatch, fulfil, monitor, cancel, return, dispute and reconcile transactions.

# 10. Service Booking Information

Where Ventra provides service-booking functionality, we may process:

\- requested service;

\- customer information;

\- provider/business information;

\- scheduled date and time;

\- booking status;

\- provider assignment;

\- arrival status;

\- service progress;

\- completion information;

\- cancellation information;

\- escalation information;

\- payment information;

\- refund information; and

\- support/dispute information.

Service bookings may progress through statuses such as requested, accepted, rejected, scheduled, provider assigned, arriving, in progress, completed, escalated and cancelled.

# 11. Payment and Financial Information

Ventra processes financial information needed to create and reconcile transactions.

This may include:

\- payment amount;

\- payment status;

\- online payment service provider order ID;

\- payment intent information;

\- payment transaction references;

\- refund records;

\- refund status;

\- partial-refund information;

\- wallet balances;

\- ledger entries;

\- business settlement information;

\- driver earnings;

\- driver payout/withdrawal information;

\- platform fees;

\- delivery platform fees;

\- business platform fees;

\- commission information;

\- GST-related information;

\- TDS-related information where applicable;

\- credit-note information; and

\- accounting/reconciliation records.

Ventra uses \*\*online payment service provider\*\* as the audited online payment provider.

The application/backend may use online payment service provider order creation, payment SDK functionality, server-side payment verification and webhook reconciliation.

Ventra does not intend to store customers' full payment-card credentials as ordinary application data.

Payment information may be shared with the payment provider and relevant financial/technical service providers to complete, verify, reconcile or refund a transaction.

# 12. Payment Environment

At the current stage of deployment, the audited Ventra implementation uses the \*\*online payment service provider sandbox environment\*\*.

Production online payment service provider credentials and production payment activation are a separate operational step.

This Privacy Policy does not represent that production payment processing has been activated merely because payment functionality exists in the application.

# 13. Refund and Return Information

Ventra may process information relating to:

\- return requests;

\- replacement requests;

\- refund requests;

\- refund reason;

\- product condition;

\- photographs/evidence;

\- business responses;

\- delivery evidence;

\- refund amount;

\- refund status;

\- refund approval;

\- payment references;

\- customer communications;

\- business communications; and

\- dispute outcomes.

For business-responsible product refunds, Ventra's operating model is that the customer may submit a return/refund request to Ventra. Ventra raises the case with the relevant business. Where the business is responsible and approves the refund, the business provides or authorizes the applicable refund amount, after which Ventra processes the customer refund.

A customer refund may therefore be processed after the original business settlement has already occurred.

The privacy processing associated with such cases is necessary to investigate the request, determine responsibility, coordinate the business response, process the refund and maintain an audit trail.

# 14. Photos, Images and Documents

Ventra may allow or require users to upload photographs, images or documents for functions such as:

\- profile photographs;

\- driver KYC;

\- driving licence verification;

\- business KYC;

\- business/product images;

\- return evidence;

\- damage evidence;

\- proof-of-delivery evidence;

\- support cases; and

\- dispute resolution.

Uploaded files may contain personal information. Users should upload only information reasonably necessary for the relevant purpose.

Ventra may restrict access to uploaded documents through application/backend security controls.

# 15. Device and Application Information

Ventra may process technical information including:

\- device model;

\- manufacturer;

\- operating system;

\- application version;

\- push-notification token;

\- device identifier information used for operational/security purposes; and

\- information needed to maintain compatibility and secure application access.

This information may be used for:

\- notification delivery;

\- device/application compatibility;

\- security;

\- fraud prevention;

\- troubleshooting;

\- account protection; and

\- service reliability.

# 16. Push Notifications

Ventra may use push-notification service to deliver operational notifications.

Examples include:

\- order updates;

\- driver assignment information;

\- delivery status;

\- payment/refund updates;

\- business order notifications;

\- driver offer notifications;

\- support notifications; and

\- other service-related communications.

FCM tokens may change when the device or application state changes and may be updated in Ventra's systems.

# 17. Analytics

The customer application may use analytics service.

Analytics information may be used to understand application usage, improve functionality, diagnose operational issues and understand product performance.

The exact analytics events and configuration may change as the application develops.

Analytics practices may change as Ventra develops. Material changes will be reflected in this Privacy Policy as appropriate.

# 18. Information We Do Not Intentionally Collect Through the Audited Core Design

Ventra does not intentionally collect through its ordinary core services:

\- SMS message content;

\- WhatsApp message content;

\- email inbox content;

\- user contact lists;

\- microphone recordings;

\- health information;

\- Bluetooth data;

\- advertising ID;

\- historical GPS trails for the driver's current-location field; or

\- raw government identity numbers as ordinary stored profile fields.

If Ventra introduces a material new category of personal-information processing, this Privacy Policy will be updated as appropriate.

# 19. How We Use Information

Ventra may use information for the following purposes.

## 19.1 Account management

\- create and authenticate accounts;

\- verify identity;

\- maintain account profiles;

\- distinguish customer, driver and business roles;

\- manage account status;

\- process account deletion requests.

## 19.2 Order fulfilment

\- create orders;

\- communicate order details;

\- coordinate businesses and drivers;

\- dispatch deliveries;

\- calculate delivery quotes;

\- track delivery status;

\- complete deliveries;

\- record proof of delivery.

## 19.3 Location-dependent operations

\- identify pickup/drop locations;

\- match drivers;

\- calculate operational distance;

\- support live tracking;

\- support navigation and dispatch.

## 19.4 Payments and accounting

\- create payment orders;

\- verify payments;

\- reconcile payment-provider webhooks;

\- process refunds;

\- maintain ledgers;

\- calculate fees and taxes;

\- process settlements and payouts.

## 19.5 KYC and compliance

\- verify drivers and businesses;

\- review submitted documents;

\- prevent identity misuse;

\- maintain compliance records;

\- investigate suspected fraud.

## 19.6 Returns and disputes

\- receive requests;

\- review evidence;

\- communicate with businesses/drivers;

\- determine operational outcomes;

\- coordinate replacements/refunds;

\- maintain dispute records.

## 19.7 Security

\- protect accounts;

\- validate authenticated requests;

\- reduce unauthorized backend access;

\- detect suspicious activity;

\- prevent duplicate financial operations;

\- investigate fraud and abuse.

## 19.8 Support

\- respond to support requests;

\- investigate complaints;

\- communicate case outcomes;

\- maintain support history.

## 19.9 Platform improvement

\- understand usage;

\- improve features;

\- diagnose technical issues;

\- improve operational processes;

\- evaluate service performance.

# 20. How Information Is Shared

Ventra may share information only where reasonably necessary for legitimate platform operations, security, compliance, payment processing, support or other permitted purposes.

## 20.1 With businesses

For a customer's shop/order transaction, the relevant business may receive information needed to:

\- accept and prepare the order;

\- contact the customer where necessary;

\- fulfil the order;

\- coordinate pickup;

\- handle return/replacement/refund requests; and

\- resolve disputes.

This may include relevant customer name, phone number, order information, delivery information and other information necessary for fulfilment.

## 20.2 With drivers

Drivers may receive information needed to perform the assigned delivery, such as:

\- pickup location;

\- drop-off location;

\- relevant recipient/sender information;

\- package instructions;

\- order details necessary for fulfilment;

\- OTP/proof-of-delivery information; and

\- information required to contact the relevant delivery participant.

Drivers must not use customer information for unrelated purposes.

## 20.3 With customers

Customers may receive information needed to understand and track their transaction, including relevant business and driver information, delivery status and operational location during an active delivery.

## 20.4 With service providers

Ventra may use third-party technology providers for authentication, databases, storage, messaging, analytics, maps, payments and backend processing.

## 20.5 With administrators

Authorized Ventra administrators may access information necessary for:

\- account support;

\- KYC verification;

\- dispute resolution;

\- refund processing;

\- fraud investigation;

\- operational dispatch;

\- payment reconciliation;

\- compliance; and

\- security.

Access should be limited to authorized personnel and legitimate purposes.

## 20.6 Legal and regulatory disclosures

Ventra may disclose information where required or permitted by applicable law, lawful governmental request, court order, regulatory process, fraud investigation or protection of users, the platform or third parties.

# 21. Third-Party Service Providers

Ventra works with selected external service providers to operate the platform. These providers may process personal information only as necessary to provide the services they support, subject to their own applicable terms and privacy practices.

Authentication and account services

Ventra uses an external authentication provider to securely create and authenticate customer, driver and business accounts. Where Google-based sign-in is selected, the relevant Google authentication service may process the information required to authenticate the account.

Cloud infrastructure and data services

Ventra uses external cloud infrastructure providers for secure application operation, databases, file storage, server-side processing, security controls and related technical services.

Mapping and location services

Ventra uses a mapping and location service provider for map display, address search, geocoding and related location functionality. Information sent to that provider is limited to what is necessary for the requested mapping or location feature.

Online payments

Ventra uses an online payment service provider for payment collection, payment verification and applicable refund processing. Ventra does not intend to store customers' full payment-card credentials as ordinary application data.

Push notifications

Ventra uses a push-notification service to deliver operational notifications such as order updates, delivery updates, payment/refund updates and driver or business notifications.

Analytics

Where enabled, Ventra may use an analytics service to understand application usage, improve functionality, diagnose issues and measure product performance.

External map applications and links

If Ventra opens an external mapping application or other third-party service, that service's own privacy policy and data practices apply to information processed directly by that service.

Third-party providers may change as Ventra develops. If a material change affects how personal information is processed, Ventra will update this Privacy Policy as appropriate.

# 22. Data Storage and Security

Ventra uses technical and organizational safeguards intended to protect personal information against unauthorized access, alteration, disclosure, loss or destruction.

Depending on the information and the service involved, safeguards may include:

No electronic system can be guaranteed to be completely secure.

Users are responsible for protecting their devices and account access and should contact Ventra promptly if they suspect unauthorized activity.

# 23. application-integrity and abuse-prevention service and Application Integrity

Ventra may use application-integrity and abuse-prevention service with Android Play Integrity to help protect backend resources from unauthorized or illegitimate application requests.

App Check is a security control and is not intended to replace authentication.

The Driver, Business and Customer applications may use Play Integrity-based App Check in release builds, subject to the final production configuration.

# 24. Data Retention

Ventra retains information only for as long as reasonably necessary for the relevant purpose, transaction lifecycle, security, dispute resolution, accounting, taxation, fraud prevention, regulatory requirements or other lawful purposes.

Because Ventra operates an order, payment, delivery and business marketplace system, some information may need to remain after an account is closed.

The following are Ventra's current operational retention targets:

\| Data category | Operational retention target |

\|---|---|

\| Orders | 7 years after completion/cancellation |

\| Financial/accounting/ledger records | 8 years or longer where legally/accounting required |

\| Security/audit logs | 3 years |

\| Ordinary notification records | 1 year |

\| Returns and disputes | 3 years after resolution |

\| KYC documents | While reasonably required for verification/compliance, and thereafter only where justified |

\| Current driver operational location | Current operational state; historical route is not intended to be maintained in the current-location field |

These periods may be extended where required by applicable law, accounting, tax, regulatory, dispute-resolution or security requirements.

Where law requires a longer retention period, Ventra may retain the information for the required period.

Where information is no longer required, Ventra should delete, anonymize or otherwise securely dispose of it, subject to backups and lawful retention requirements.

# 25. Account Deletion

Ventra provides account-deletion request functionality for customers, drivers and businesses.

A deletion request may:

1\. identify the account;

2\. record the deletion request;

3\. create an audit event;

4\. notify relevant systems;

5\. restrict new orders/bookings while the request is processed; and

6\. initiate the applicable deletion/anonymization workflow.

## 25.1 Deletion does not necessarily mean immediate destruction of every record

Some records may need to be retained after account deletion, including:

\- financial records;

\- accounting records;

\- transaction records;

\- order records;

\- audit records;

\- returns;

\- disputes;

\- fraud/security records; and

\- information required by law.

Where continued retention is necessary, Ventra should retain only what is reasonably required and should delete or anonymize information that no longer has a legitimate retention basis.

## 25.2 Technical deletion status

The application audit identified that the authentication service user-deletion step and complete administrative anonymization were not fully implemented/verified at the time this policy was drafted.

Deletion does not necessarily mean immediate destruction of every record, because some information may need to be retained for lawful or legitimate purposes.

Where applicable, Ventra will maintain procedures for:

\- authentication service user deletion;

\- profile-data deletion/anonymization;

\- photo deletion;

\- KYC-document handling;

\- active-order handling;

\- financial-record retention;

\- dispute/return retention;

\- administrative anonymization; and

\- the complete end-to-end deletion process.

# 26. Data Subject / User Privacy Requests

Depending on applicable law, users may request information or action relating to their personal information.

Requests may include:

\- access to applicable personal information;

\- correction of inaccurate information;

\- deletion where legally available;

\- withdrawal of consent where applicable;

\- information about processing;

\- grievance or complaint;

\- correction of account details; and

\- other legally applicable rights.

Ventra may need to verify the identity of the requester before processing a request involving sensitive information.

Requests can be sent to:

\*\*support\@creatorcloud.in\*\*

or

\*\*Grievance Officer — Tabrez\*\*

\*\*gpttabrez\@gmail.com\*\*

\*\*+91 9738841367\*\*

# 27. Withdrawal of Permissions

Users can manage certain application permissions through their device settings.

For example, a user may manage:

\- location permissions;

\- notification permissions;

\- camera/photo permissions; and

\- other Android permissions presented by the application.

Withdrawing a permission may prevent a feature from working.

For example, delivery and driver functions that require location cannot operate normally without the necessary location permission.

Permission withdrawal does not necessarily delete information already lawfully processed before withdrawal. Existing information is handled according to this policy, applicable retention rules and applicable law.

# 28. Cookies and Similar Technologies

The mobile applications primarily use application technologies, authentication state, device information, notification tokens and backend services rather than traditional browser cookies.

If Ventra later introduces a public website or web application that uses cookies or similar technologies, an appropriate web/cookie notice may be added.

# 29. Communications

Ventra may communicate with users through:

\- in-app notifications;

\- push notifications;

\- email where configured;

\- telephone/mobile contact where necessary;

\- support communications; and

\- transaction-related communications.

Operational communications may be necessary to fulfil an order or service and therefore may not be optional.

Users should not send passwords, authentication codes, full payment-card numbers or other unnecessary secrets through support channels.

# 30. Fraud, Abuse and Security Investigations

Ventra may process information to identify and investigate:

\- fake orders;

\- payment fraud;

\- unauthorized payment use;

\- duplicate refund claims;

\- false return claims;

\- false delivery attempts;

\- GPS manipulation;

\- identity misuse;

\- account sharing;

\- KYC fraud;

\- review manipulation;

\- platform abuse;

\- unauthorized access; and

\- other suspicious activity.

This may involve reviewing account, device, order, payment, location, delivery, support, KYC and audit information relevant to the investigation.

Ventra may restrict or suspend accounts where reasonably necessary to protect the platform, users or service participants, subject to applicable law.

# 31. Reviews, Ratings and User-Submitted Content

Ventra may process information submitted through:

\- ratings;

\- reviews;

\- product/catalog submissions;

\- support requests;

\- dispute submissions;

\- return requests;

\- photographs;

\- evidence; and

\- other platform forms.

Users must ensure submitted content is accurate and lawful.

Users should not submit another person's private information unless it is necessary for the relevant transaction and the user is authorized to provide it.

Ventra may review, moderate, restrict or remove content that violates platform rules or applicable law.

# 32. Business and Driver Access to Customer Information

Because Ventra coordinates physical delivery, certain customer information must be shared with the business and/or driver responsible for the transaction.

Such sharing is limited to information reasonably necessary to perform the service.

Examples may include:

\- recipient name;

\- phone number;

\- pickup address;

\- drop-off address;

\- package instructions;

\- order contents necessary for fulfilment;

\- delivery OTP;

\- delivery status; and

\- other operational information.

Drivers and businesses must not use this information for unrelated marketing, harassment, solicitation, surveillance or other unauthorized purposes.

# 33. International and Cross-Border Processing

Ventra uses third-party cloud and technology providers. Depending on provider infrastructure and configuration, information may be processed or stored in locations outside the user's immediate location.

The relevant service providers may operate infrastructure in multiple jurisdictions.

Where cross-border processing is applicable, Ventra will handle it subject to applicable law and contractual/provider safeguards where required.

Provider infrastructure and processing locations may change over time.

# 34. Data Breach and Security Incidents

If Ventra becomes aware of a security incident affecting personal information, Ventra may investigate, contain and remediate the incident and make notifications required by applicable law or regulatory requirements.

Incident handling may involve:

\- identifying affected systems;

\- restricting access;

\- investigating logs;

\- identifying affected information;

\- preserving evidence;

\- restoring secure operation;

\- notifying relevant parties where legally required; and

\- taking measures to reduce further risk.

# 35. Third-Party Links and Applications

Ventra may provide links or launch external applications, including mapping/payment or other service interfaces.

Once you leave Ventra and interact directly with an external service, that service's own privacy policy applies to information it processes.

Ventra is not responsible for the privacy practices of third-party services outside its control.

# 36. Business, Driver and Customer Responsibilities

Users must provide accurate information and should update information when it changes.

Users must not:

\- impersonate another person;

\- submit fraudulent documents;

\- provide unauthorized payment information;

\- misuse another person's account;

\- misuse location information;

\- collect customer/driver information for unrelated purposes;

\- attempt to access unauthorized systems;

\- manipulate transactions;

\- create fraudulent orders;

\- abuse returns/refunds;

\- manipulate ratings; or

\- interfere with platform security.

# 37. Financial and Transaction Records

Financial records may be retained after account deletion where required for:

\- accounting;

\- taxation;

\- payment reconciliation;

\- settlement;

\- refund processing;

\- dispute resolution;

\- fraud prevention;

\- audit; or

\- legal compliance.

This includes records associated with:

\- customer payments;

\- business settlements;

\- driver payouts;

\- wallet adjustments;

\- refunds;

\- charge/dispute information;

\- platform fees;

\- GST;

\- TDS where applicable; and

\- credit notes.

# 38. Refunds After Business Settlement

A business settlement does not necessarily end the privacy lifecycle of an order.

For example:

\*\*Customer order:\*\* ₹500

\*\*Business settlement:\*\* completed after approximately 24 hours

\*\*Later valid return request:\*\* submitted within the applicable return window

In this situation, Ventra may process:

1\. the customer's return request;

2\. product/order information;

3\. business response;

4\. evidence;

5\. refund approval;

6\. business refund obligation;

7\. amount authorized/provided by the business;

8\. Ventra refund processing; and

9\. payment reconciliation.

The relevant records may therefore remain necessary after the original settlement date.

# 39. Delivery Failures and Re-delivery

Ventra may record:

\- delivery attempts;

\- recipient-unavailable information;

\- driver status;

\- timestamps;

\- location relevant to the delivery;

\- proof-of-delivery information;

\- failed-delivery reasons;

\- return-to-business information; and

\- re-delivery information.

This information is used to complete or resolve the transaction, investigate disputes and maintain appropriate operational/audit records.

# 40. Service Availability

Ventra initially operates in:

\- Bengaluru;

\- Kolar District; and

\- Mulbagal Taluk.

Availability may vary by exact location, active business/service zones, driver availability, product/service eligibility and operational capacity.

Location information may therefore be processed to determine whether a requested service can be fulfilled.

# 41. Retention of Support and Grievance Records

Support and grievance communications may be retained for a reasonable period necessary to:

\- resolve the matter;

\- document the response;

\- investigate repeated complaints;

\- prevent fraud;

\- demonstrate compliance;

\- handle disputes; or

\- satisfy legal requirements.

Users should avoid including unnecessary sensitive information in support communications.

# 42. Changes to This Privacy Policy

Ventra may update this Privacy Policy when:

\- application functionality changes;

\- new data categories are introduced;

\- third-party providers change;

\- payment or delivery systems change;

\- legal requirements change;

\- retention practices change; or

\- security/privacy practices are materially updated.

When material changes occur, Ventra should update the effective date and provide an appropriate notice through the application or relevant public channel where required.

The latest published version is intended to describe the current processing practices.

# 43. Contact Information

For privacy questions, account/data requests and support:

\*\*Advisory Mediacare Services\*\*

\*\*Brand:\*\* Ventra

\*\*Bengaluru, Karnataka, India\*\*

\*\*Support Email:\*\* support\@creatorcloud.in

\*\*Support Phone:\*\* +91 9738841367

### Grievance Officer

\*\*Name:\*\* Tabrez

\*\*Email:\*\* gpttabrez\@gmail.com

\*\*Phone:\*\* +91 9738841367

For formal legal correspondence, the operator may be contacted at its registered office in Bengaluru, Karnataka, India.

# 44. Governing Law

This Privacy Policy is intended to operate under applicable laws of India and the State of Karnataka, subject to mandatory rights and protections applicable to users.

Disputes relating to this Privacy Policy are intended to be subject to competent courts in Bengaluru, Karnataka, to the extent legally permissible.

# 45. Policy Accuracy and Updates

Ventra intends to keep this Privacy Policy reasonably aligned with its services and data-processing practices.

The policy may be updated when:

When material changes are made, Ventra will update the effective date and provide an appropriate notice through the application or another suitable public channel where required.

Users should review the latest published version periodically.

## Document Control

\*\*Document:\*\* Ventra Privacy Policy

\*\*Version:\*\* 1.0

\*\*Effective date:\*\* 7 September 2026

\*\*Operator:\*\* Advisory Mediacare Services

\*\*Brand:\*\* Ventra

\*\*Business structure:\*\* Proprietorship

\*\*Status:\*\* Customer-facing publication draft