Effective date: 3 September 2026
Last updated: 8 October 2026

1. Who we are

Truffl is a brand operated by Oravio AI Private Limited ("Truffl", "Oravio", "we", "us" or "our").

Registered office:

Flat No. 024, B-Block, No. 97/2, DS Max Signature,
Devinagar Main Road, Near LKR Nagar, RMV Stage 2,
Bengaluru, Karnataka - 560094, India

GSTIN: 29AAFCO2667R1ZJ

Privacy and grievance contact: as@trufflinnovations.in
Telephone: +91 63614 21009

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you:

• visit our website or interact with our online content;
• contact us, request access, schedule a meeting or communicate with us;
• use a Truffl workspace, studio, API, SDK, integration or other service made available by us;
• participate in a call or other interaction powered by Truffl; or
• otherwise engage with Truffl as a customer, prospect, developer, partner, supplier or authorised user.

This policy also applies to personal data processed through Truffl's Facebook/Meta application and WhatsApp Business integrations, where the relevant features are enabled and authorised.

2. The roles of Truffl and its customers

Truffl processes personal data in different roles depending on the context.

2.1 When Truffl determines the purpose

Truffl generally acts as the data fiduciary or controller for personal data relating to:

• website visitors;
• access applicants and sales enquiries;
• customer account administrators and authorised workspace users;
• billing, contracting and business contacts;
• security, service integrity and legal compliance; and
• Truffl's own communications and marketing.

2.2 When an enterprise customer determines the purpose

When a Truffl customer uses the Services to operate a voice agent, customer-support workflow, revenue-recovery workflow, embedded application experience or other interaction, that customer generally determines why the end user's personal data is processed. In that context:

• the customer acts as the data fiduciary or controller; and
• Truffl acts as the customer's data processor or service provider and processes the data on documented instructions, subject to the applicable agreement.

The customer's privacy notice and choices govern its collection and use of end-user data. Questions or requests concerning a customer-operated interaction should normally be directed to that customer. We will assist the customer as required by law and our agreement.

If Truffl and a customer determine purposes jointly in a particular deployment, the applicable contract should allocate the parties' responsibilities.

3. Personal data we collect

Depending on how you interact with Truffl, we may collect the following categories.

3.1 Information you provide directly

• name, work email address, telephone number, company, role and location;
• access-request, contact-form and meeting-scheduling information;
• pricing-calculator inputs, selected models, generated quotes, timestamps and a browser identifier used to maintain quote records;
• account credentials and authentication information;
• communications, support requests, feedback and survey responses;
• contracting, billing and transaction information;
• configuration information, prompts, workflows, evaluation criteria and instructions submitted to the Services; and
• any other information you choose to provide.

3.2 Voice and interaction data

Where enabled by a customer deployment, the Services may process:

• live audio and voice recordings;
• transcripts and conversation summaries;
• caller and business telephone numbers, where available;
• speaker turns, timestamps, interruptions and other interaction events;
• detected intent, language, sentiment or other model-generated attributes;
• identifiers supplied by the customer, such as customer, order, account, ticket or session identifiers;
• contextual information retrieved from connected systems;
• tool calls, actions, approvals, fallbacks, transfers and outcomes;
• provider requests and responses retained for authorised diagnostics, including relevant instructions, conversation text, tool results and technical metadata;
• quality reviews, evaluation scores, annotations and reviewer comments; and
• technical metadata such as call status, duration, routing, latency and provider events.

Whether a call is recorded, and what notice or consent is required, depends on the customer's configuration and applicable law. Customers are responsible for providing legally required notices and obtaining legally required permissions before using Truffl to place, receive, record or analyse communications.

3.3 Workspace and integration data

• workspace membership, roles and permissions;
• agent versions, deployment settings and operational history;
• data exchanged with integrations selected by the customer;
• API requests, SDK events, webhook payloads and associated metadata;
• audit trails and administrative actions; and
• usage information relating to features and service performance.

3.4 Automatically collected website and device data

• IP address, device and browser type, operating system and approximate location;
• pages viewed, referring URLs, timestamps, clicks and navigation events;
• cookie identifiers, advertising identifiers and campaign attribution data;
• login, authentication and security events; and
• diagnostic, crash, performance and fraud-prevention data.

Our use of cookies and similar technologies is described in the Cookie Notice.

3.5 Data obtained from third parties

We may receive personal data from:

• the organisation that provides you access to Truffl;
• customers that configure Truffl interactions;
• identity, authentication and security providers;
• telephony, speech, language-model, hosting, analytics, advertising and scheduling providers;
• connected applications and data sources selected by a customer;
• referral partners and publicly available professional sources; and
• regulators, law-enforcement bodies or other parties where permitted by law.

3.6 Meta and WhatsApp Business data

Where a customer authorises a Meta or WhatsApp Business integration, we may process the information needed to operate the enabled features, within the permissions granted to Truffl:

• business, WhatsApp Business Account and connected phone-number identifiers;
• authorised administrator or account information made available through the granted permissions;
• recipient telephone numbers and WhatsApp identifiers;
• message content and attachments exchanged through the integration;
• message templates, template status, message identifiers, timestamps, delivery status and related webhook events; and
• integration permissions, access tokens and connection-status information.

We use this information to connect the authorised business account, operate the requested business communications, deliver and receive messages, record outcomes and support the integration. We do not obtain access to all of a person's Facebook activity or private conversations merely because a business account is connected.

Authorising a business-account connection is separate from any notice, consent or opt-in required to communicate with its customers. Meta Platform Data is used only for the authorised purposes described in this policy and permitted by the applicable Meta and WhatsApp terms.

4. How we use personal data

We may use personal data to:

1. provide, configure, operate, maintain and support the Services;
2. authenticate users and administer workspaces, roles and permissions;
3. process conversations, context, tool calls, actions and outcomes at a customer's direction;
4. connect the Services to customer-selected systems and providers;
5. monitor availability, quality, latency, security and operational performance;
6. troubleshoot incidents, prevent abuse and protect users, customers and the Services;
7. evaluate and improve prompts, workflows, routing, interfaces and product functionality;
8. respond to enquiries, review access requests and schedule meetings;
9. manage customer relationships, contracts, payments and business operations;
10. send service notices and, where permitted, product or marketing communications;
11. measure website use, attribute campaigns and deliver or measure advertising, subject to required consent and opt-out rights;
12. comply with legal obligations, enforce agreements and establish or defend legal claims; and
13. create aggregated or de-identified information that does not reasonably identify an individual.

5. Legal grounds

We process personal data only where permitted under applicable law. Depending on the jurisdiction and context, the basis may include:

• your free, specific, informed and unambiguous consent;
• processing necessary to provide a service you requested or to take steps at your request;
• certain legitimate uses recognised by applicable law;
• our legitimate interests, where applicable and not overridden by your rights, including operating and securing the Services, responding to business enquiries and improving product performance;
• performance of a contract;
• compliance with a legal obligation; or
• establishment, exercise or defence of legal claims.

Where we rely on consent, you may withdraw it using the method presented at collection, through cookie settings where relevant, or by contacting us. Withdrawal does not affect processing already lawfully completed and may limit features that depend on the relevant data.

6. AI and automated processing

Truffl uses automated systems and third-party models to interpret interactions, generate responses, select workflows, evaluate quality and support actions. These systems can make mistakes.

Customers configure the permitted scope of their agents, connected tools, approval requirements, fallbacks and human handoffs. Customers must not use Truffl as the sole basis for decisions that produce legal or similarly significant effects on individuals unless the use is lawful, appropriately governed and expressly supported by the applicable agreement.

Customer Content and model training: Truffl does not use a customer's recordings, transcripts, messages or other Customer Content to train models for other customers by default. Such use may occur only after documented tenancy and data-governance policies have been established, the customer has provided separate, explicit, informed consent, and any additional permissions required from the individuals concerned have been obtained.

A separate training notice will identify the data used, purpose, intended model use, recipients, retention period, safeguards and withdrawal process, including how models already trained will be treated. Declining training consent does not prevent use of the core service. Consent does not authorise uses prohibited by applicable law or Meta, WhatsApp or other provider terms.

Aggregated or de-identified service information may be used to improve reliability, safety and performance where it cannot reasonably identify a person or customer and the use is otherwise permitted. A redacted label alone does not establish that information is anonymous.

7. How we disclose personal data

We may disclose personal data to:

7.1 Customer-authorised recipients

The customer that controls a workspace and its authorised users may access data processed within that workspace according to assigned permissions.

7.2 Service providers and subprocessors

We use vendors to provide infrastructure, hosting, storage, telephony, speech processing, language models, communications, authentication, monitoring, analytics, advertising, scheduling, customer support and professional services. They may process personal data only for authorised purposes and subject to contractual safeguards appropriate to their role.

A current list of material subprocessors, their processing purposes and relevant processing locations is available to customers on request. Where required by an applicable agreement, we will provide notice of material changes to that list.

Information needed to send or receive authorised WhatsApp communications is exchanged with Meta/WhatsApp. Their own privacy notices and applicable business terms govern their processing. Relevant audio, text or business context may also be sent to the speech and language-model providers used for a Truffl interaction.

7.3 Business and professional advisers

We may disclose information to auditors, insurers, banks, lawyers, accountants and other professional advisers where reasonably necessary.

7.4 Legal, safety and compliance recipients

We may disclose information where reasonably necessary to comply with law or legal process, respond to lawful requests, protect rights or safety, investigate fraud or security incidents, or enforce agreements.

7.5 Corporate transactions

Information may be disclosed in connection with a financing, merger, acquisition, reorganisation, sale of assets or similar transaction, subject to appropriate confidentiality and legal safeguards.

7.6 Advertising and analytics partners

If you consent where required, website identifiers and activity may be disclosed to analytics and advertising partners for measurement, attribution, personalisation or cross-context behavioural advertising. Depending on applicable law, this may be considered a "sale," "sharing" or targeted advertising even where no money changes hands. You may reject non-essential cookies or change your preferences at any time. Where required, we will honour recognised opt-out preference signals.

We do not knowingly sell voice recordings, transcripts or Customer Content for monetary consideration.

8. International processing and transfers

Truffl and its providers may process personal data in India and other countries where they operate. Those countries may have different data-protection laws.

Where applicable law requires transfer safeguards, we will use appropriate contractual or legal mechanisms. For EEA, UK or Swiss data, these may include adequacy decisions, approved standard contractual clauses and supplementary measures. Transfers from India will remain subject to restrictions or requirements notified under applicable Indian law and any sector-specific localisation obligations that apply to the customer.

Customers requiring a specific processing region or data-residency arrangement must ensure it is stated in the applicable Order Form or Data Processing Addendum.

9. Retention and deletion

Retention depends on the purpose of processing, the applicable customer agreement, supported retention settings and legal obligations. There is currently no single automatic expiry period that applies to all Truffl recordings, transcripts and Customer Content. These records may remain stored until deletion is arranged, subject to applicable legal requirements. Customers may contact us to establish the retention and deletion arrangements applicable to their deployment.

Certain diagnostic records have separate retention settings. Those settings do not determine the retention of an entire call, its recordings or other copies. Account, enquiry and support information is retained for the associated service or business purpose; accounting, security and other legally required records follow the applicable statutory requirements.

For Meta Platform Data, we apply the deletion requirements of the applicable Meta terms, including when it is no longer needed for an authorised purpose, a valid deletion request is received, or the relevant customer relationship ends, unless retention is legally required. A business-account disconnection stops access through that connection but does not necessarily delete information already stored. You may request deletion separately using the instructions in section 11.

Backup and archival copies may follow different deletion procedures from active systems. Removing an active record does not immediately remove every backup or object version; recording archives may require separate deletion. We consider these copies when handling deletion requests and applicable retention obligations. Deletion by Truffl does not automatically delete independent copies held by a customer, Meta/WhatsApp, a carrier or another provider.

Where information must be preserved for legal compliance, an investigation or a legal claim, its continued use is restricted to that purpose. Required preservation does not authorise unrelated marketing or shared model training. Separately consented training data follows the retention and withdrawal terms disclosed in the relevant training notice. Aggregated or de-identified information may be retained where it no longer identifies an individual and the use is otherwise permitted.

10. Security

We use administrative, organisational and technical safeguards designed to protect personal data against unauthorised access, acquisition, disclosure, alteration, loss or destruction. Measures may include access controls, authentication, encryption in transit and where appropriate at rest, tenant separation, logging, monitoring, vulnerability management, backups, incident response and vendor review.

No service is completely secure. Customers are responsible for protecting credentials, configuring permissions, reviewing authorised integrations and notifying us promptly of suspected compromise.

We will notify affected customers or individuals and relevant authorities of qualifying personal-data breaches as required by applicable law and contract.

11. Your rights and choices

Subject to applicable law and exceptions, you may have rights to:

• obtain information about personal data processed and processing activities;
• access a summary or copy of personal data;
• correct, complete or update inaccurate or incomplete data;
• request erasure or deletion;
• withdraw consent;
• object to or restrict certain processing;
• receive portable data where applicable;
• opt out of marketing, targeted advertising, sale or sharing where applicable;
• nominate another person to exercise rights where applicable; and
• seek grievance redressal or complain to the competent regulator.

To exercise a right relating to data controlled directly by Truffl, email as@trufflinnovations.in with the subject Privacy Request. We may verify your identity and authority before acting. We will respond within the period required by applicable law.

For data processed on behalf of a Truffl customer, contact that customer first. If you contact us, we may forward the request to the relevant customer and assist it in responding.

Data deletion requests, including Meta/WhatsApp data

To request deletion of personal data held by Truffl, including information obtained through Truffl's Meta application or WhatsApp integration, email as@trufflinnovations.in with the subject Data Deletion Request. This request method is available even if you do not have an active Truffl account.

Provide a contact address for our response, the relevant business or workspace if known, and enough information to identify the account or interaction and the data you want deleted. Do not send passwords, access tokens or unnecessary sensitive documents. We may request proportionate information to verify your identity or authority and may coordinate with the customer responsible for the interaction.

We will respond within the period required by applicable law and explain any applicable retention exception where permitted. Removing an integration is not a substitute for a deletion request concerning data already stored.

Marketing choices

You may unsubscribe through the link in a marketing email or contact us. You may still receive necessary service, security and account communications.

Cookie and advertising choices

Use Cookie Settings in the website footer to reject or withdraw consent for non-essential technologies. Where applicable, we will also recognise legally required browser-based opt-out signals. See the Cookie Notice for details.

12. Children

The website and Services are intended for businesses and authorised adult users, not for children. We do not knowingly collect personal data directly from children for account creation or marketing.

Customers must not configure Truffl to process children's personal data unless the deployment has been expressly approved in writing, the customer has established a lawful basis, required verifiable parental or guardian consent has been obtained, and all additional safeguards required by law are implemented.

If you believe a child has provided personal data directly to Truffl without appropriate authorisation, contact us.

13. Third-party services

The Services may link to or integrate with third-party services. Their privacy practices are governed by their own notices. A customer's decision to connect a third-party service authorises Truffl to exchange data with it as needed to provide the integration, subject to the customer's agreement and configuration.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, data practices or legal obligations. We will post the updated version with a revised date. If a change materially affects how we use personal data, we will provide additional notice or obtain consent where required.

15. Contact and grievance redressal

Questions, complaints and rights requests may be sent to:

Privacy and Grievance Contact
Oravio AI Private Limited (Truffl)
Flat No. 024, B-Block, No. 97/2, DS Max Signature,
Devinagar Main Road, Near LKR Nagar, RMV Stage 2,
Bengaluru, Karnataka - 560094, India
Email: as@trufflinnovations.in
Telephone: +91 63614 21009

If you are not satisfied with our response, you may escalate the matter to the competent data-protection or other regulatory authority after using our grievance-redressal process where applicable.

Effective date: 3 September 2026
Last updated: 3 September 2026

1. About these Terms

These Terms of Service ("Terms") are a binding agreement between Oravio AI Private Limited, operating under the brand Truffl ("Truffl", "Oravio", "we", "us" or "our"), and the person or organisation accessing or using the Services ("Customer", "you" or "your").

Registered office:

Flat No. 024, B-Block, No. 97/2, DS Max Signature,
Devinagar Main Road, Near LKR Nagar, RMV Stage 2,
Bengaluru, Karnataka - 560094, India

GSTIN: 29AAFCO2667R1ZJ

By accessing the website, activating an account, clicking acceptance, executing an Order Form that incorporates these Terms or using the Services, you agree to these Terms. If you act for an organisation, you represent that you have authority to bind it.

If you do not agree, do not access or use the Services.

2. Definitions

• Authorised User means an individual whom Customer authorises to use the Services under its account.
• Customer Content means data, audio, recordings, transcripts, prompts, configurations, instructions, files, evaluation material, integration data and other content submitted to or processed through the Services by or for Customer. It does not include Truffl Technology or Usage Data.
• Documentation means technical or usage documentation made available by Truffl.
• Order Form means a written or electronic ordering document agreed by the parties.
• Professional Services means configuration, implementation, integration, forward-deployed engineering, support, training or other professional services described in an Order Form or Statement of Work.
• Services means the Truffl website, workspaces, studios, voice and interaction runtime, APIs, SDKs, integrations, dashboards, evaluation tools, professional services and related functionality that Truffl makes available.
• Third-Party Service means a model, telephony carrier, speech provider, hosting service, application, data source or other third-party product used with the Services.
• Truffl Technology means the Services, software, models, orchestration, interfaces, workflows, documentation, methods, templates and related technology owned or licensed by Truffl, excluding Customer Content.
• Usage Data means technical, operational, security and usage information generated through use of the Services, excluding information that identifies Customer or an individual when used outside service delivery.

3. Contract hierarchy

If Customer and Truffl enter into a signed Master Services Agreement, Order Form, Data Processing Addendum, Service Level Agreement or Statement of Work, those documents form part of the agreement.

In the event of conflict, the following order applies unless a signed document expressly states otherwise:

1. Data Processing Addendum, for personal-data processing matters;
2. Order Form;
3. Master Services Agreement;
4. Statement of Work, for the relevant Professional Services;
5. Service Level Agreement;
6. these Terms; and
7. Documentation.

Commercial commitments, service levels, deployment scope, fees, data residency and implementation milestones exist only if stated in a signed applicable document.

4. Eligibility and accounts

You must be legally capable of entering into this agreement and at least 18 years old. The Services are intended for business use.

Access may require Truffl's approval or an invitation from an authorised workspace administrator. A request for access does not create an account or guarantee access.

You must:

• provide accurate account information;
• protect credentials and use reasonable security controls;
• ensure each account is used only by its assigned Authorised User;
• promptly remove access for users who no longer require it;
• notify Truffl promptly of suspected unauthorised access; and
• remain responsible for activity occurring through your account, except to the extent caused by Truffl's breach.

Workspace administrators may manage users, permissions, integrations and Customer Content. Customer is responsible for its administrators' actions.

5. Provision of the Services

Subject to the agreement, Truffl grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable term for Authorised Users to access and use the Services for Customer's internal business purposes and approved deployments.

The Services may include preview, beta, private-access or experimental functionality. Such functionality may change, be suspended or be withdrawn and may not be covered by service levels unless an Order Form states otherwise.

Truffl may update the Services to improve performance, security, compliance or functionality, provided that paid core functionality is not materially reduced during an active committed term except where necessary for law, security or third-party dependency changes.

6. Enterprise deployments and Professional Services

Truffl may provide FDE-led implementation, custom enterprise workspaces and embedded voice or application integrations. The scope, responsibilities, assumptions, acceptance criteria, dependencies, timeline and fees for such work must be stated in an Order Form or Statement of Work.

Unless expressly agreed:

• Customer will provide timely access to systems, personnel, documentation and test data;
• Customer is responsible for the accuracy and lawfulness of business rules, policies and data supplied to Truffl;
• delays caused by Customer dependencies may change delivery dates;
• production deployment requires Customer approval of applicable workflows, notices, controls and escalation paths; and
• custom configuration does not transfer ownership of Truffl Technology.

7. Customer responsibilities for voice and automated interactions

Customer controls the purpose, audience, content, timing, connected systems and permitted actions of its deployment. Customer is responsible for ensuring that its use complies with all applicable laws, regulations, industry rules and contractual obligations.

Without limiting that responsibility, Customer must:

1. provide all legally required disclosures that an interaction involves an automated or AI system;
2. provide recording notices and obtain consent where required;
3. obtain and maintain lawful permission to contact each recipient;
4. comply with do-not-call, customer-preference, telemarketing, sender-registration, number-use, calling-hour and commercial-communication requirements;
5. maintain suppression lists and promptly honour opt-outs;
6. use only telephone numbers, caller identities, headers, templates and communication routes that Customer is authorised to use;
7. establish human handoff, escalation, fallback and emergency procedures appropriate to the use case;
8. test workflows, prompts, integrations and actions before production use;
9. monitor outcomes and correct unsafe, misleading or inaccurate behaviour;
10. ensure connected tools expose only the permissions and data necessary for the approved purpose; and
11. avoid presenting generated content as professional, legal, medical, financial or emergency advice unless the deployment is lawful, appropriately supervised and expressly approved by Truffl in writing.

Truffl may require evidence of consent, registration or lawful authority and may suspend a deployment that creates legal, safety, fraud, spam or platform-integrity risk.

8. Acceptable use

You must not use the Services to:

• violate law, regulation, sanctions, court order or another person's rights;
• make unsolicited, deceptive, fraudulent, harassing or abusive communications;
• impersonate a person or misrepresent that an automated system is human where disclosure is required;
• facilitate phishing, credential theft, scams, malware, surveillance or unauthorised access;
• collect or infer highly sensitive information without a lawful, necessary and approved purpose;
• exploit children or process children's data without required approvals and safeguards;
• discriminate unlawfully or make prohibited high-impact decisions;
• generate or distribute illegal, infringing, defamatory or harmful content;
• bypass authentication, rate limits, usage limits, safety controls or technical restrictions;
• probe, scan or test vulnerabilities without written permission;
• reverse engineer, copy or derive source code or underlying components except where law prohibits that restriction;
• resell, sublicense or provide the Services to third parties except as authorised in an Order Form;
• use the Services or outputs to build or train a competing platform or model, except with written permission;
• overload, disrupt or interfere with the Services or other customers; or
• submit data that Customer lacks the right to process or instruct Truffl to process.

Truffl may investigate suspected violations and limit or suspend access where reasonably necessary to prevent harm. Where practical and lawful, Truffl will notify Customer and allow remediation.

9. Customer Content and data rights

As between the parties, Customer retains its rights in Customer Content. Customer grants Truffl and its subprocessors a limited right to host, copy, transmit, transform and otherwise process Customer Content only to:

• provide and support the Services;
• follow Customer's documented instructions;
• prevent or address security, fraud, abuse or technical problems;
• comply with law; and
• perform other activities expressly permitted by the agreement.

Customer represents that it has all rights, notices, consents and lawful bases necessary for Truffl to process Customer Content as instructed.

Truffl will not use Customer Content to train a general-purpose model for unrelated customers unless Customer expressly agrees in writing.

Customer must not place sensitive, regulated or sector-restricted data into the Services unless the applicable deployment and agreement expressly support it.

Personal-data processing is further governed by the Privacy Policy and, where applicable, a Data Processing Addendum.

10. Third-Party Services

Customer may choose or authorise Third-Party Services. Their availability, performance, outputs and terms are controlled by their providers.

Customer authorises Truffl to exchange Customer Content with selected Third-Party Services as necessary to provide the requested functionality. Customer is responsible for maintaining required third-party accounts, licences and permissions unless the Order Form states otherwise.

Truffl is not responsible for a Third-Party Service's independent acts, changes, outages or discontinuation. Truffl may replace a provider where reasonably necessary for availability, performance, security or compliance, subject to contractual data-processing commitments.

11. AI outputs and actions

AI-generated responses, classifications, evaluations and actions may be incomplete, inaccurate, inappropriate or non-unique. Latency, speech recognition, caller behaviour, network conditions, model changes and connected-system data can affect results.

Customer must apply human review and approval proportionate to the risk. Customer must not rely on the Services as the sole basis for decisions or actions that may materially affect a person's legal rights, safety, access to essential services, employment, credit, insurance, healthcare or similar interests unless expressly agreed and lawfully governed.

Configured permissions and controls reduce risk but do not eliminate it. Customer remains responsible for approving production behaviour, tool permissions and business outcomes.

12. Intellectual property

Truffl and its licensors own all rights in Truffl Technology. No rights are granted except those expressly stated in the agreement.

If Customer provides feedback or suggestions, Customer grants Truffl a perpetual, irrevocable, worldwide, royalty-free right to use them without restriction, provided Truffl does not publicly identify Customer as the source without permission.

Unless an Order Form states otherwise, deliverables created through Professional Services may include:

• Customer-specific configurations and Customer Content, which remain Customer's; and
• Truffl Technology, reusable components, methods, templates, connectors and know-how, which remain Truffl's.

Neither party may use the other party's names, trademarks or logos publicly without prior permission, except as expressly agreed.

13. Confidentiality

Each party may receive non-public information that a reasonable person would understand to be confidential. The receiving party will:

• use it only to perform or exercise rights under the agreement;
• protect it using at least reasonable care;
• disclose it only to personnel and contractors who need it and are bound by confidentiality duties; and
• return or destroy it when required, subject to lawful retention and routine backups.

Confidential information excludes information that the receiving party can demonstrate was lawfully known without restriction, becomes public without breach, is independently developed, or is lawfully received from another source.

Required disclosure is permitted if the receiving party gives advance notice where lawful and reasonable assistance at the disclosing party's expense.

14. Security and incidents

Truffl will maintain reasonable administrative, technical and organisational safeguards appropriate to the Services and risk. Any specific security commitments, audit rights, certifications, data location or incident-notification timelines must be stated in the applicable agreement.

Customer is responsible for secure configuration of its accounts, users, integrations, credentials and tool permissions.

The parties will cooperate regarding qualifying security incidents as required by applicable law and the Data Processing Addendum.

15. Fees, taxes and payment

Fees, usage measures, billing terms and committed quantities are stated in the applicable Order Form. Unless it states otherwise:

• fees are quoted exclusive of applicable taxes;
• Customer is responsible for taxes other than taxes on Truffl's net income;
• invoices are due within 30 days;
• overdue undisputed amounts may accrue interest at the lower of 1.5% per month or the maximum lawful rate; and
• usage above committed or included quantities may be billed at the applicable overage rate.

Customer must raise a good-faith invoice dispute within 15 days and pay undisputed amounts on time.

Free, trial or private-preview access may be limited or withdrawn at any time unless agreed otherwise in writing.

16. Suspension

Truffl may suspend all or part of the Services where reasonably necessary because of:

• a security threat or suspected unauthorised access;
• unlawful, abusive, fraudulent or unsafe use;
• material breach of the agreement;
• overdue undisputed fees after notice and an opportunity to cure;
• a third-party provider, regulator or authority requiring suspension; or
• use that threatens the Services or other customers.

Where practicable, Truffl will limit the suspension to the affected portion, provide notice and restore access after the issue is resolved.

17. Term and termination

These Terms begin when you first accept or use the Services and continue while you use them. An Order Form may specify a committed term and renewal process.

Either party may terminate an applicable agreement for material breach if the breach is not cured within 30 days after written notice, or immediately where the breach cannot be cured. Either party may terminate if the other becomes insolvent, subject to applicable law.

Truffl may terminate unpaid, free or preview access on reasonable notice, or immediately for serious legal, safety or security risk.

On termination:

• Customer's right to use the affected Services ends;
• outstanding fees become due;
• Customer Content will be returned or deleted according to the applicable agreement and retention schedule; and
• provisions that by nature should survive will survive, including confidentiality, intellectual property, accrued payment obligations, disclaimers, liability limits, indemnities and dispute provisions.

18. Warranties

Each party warrants that it has authority to enter into the agreement.

Truffl warrants that paid Services will be performed materially in accordance with applicable Documentation and Professional Services will be performed with reasonable skill and care. Customer's exclusive remedy for breach is for Truffl to re-perform or correct the affected Services, and if Truffl cannot do so within a reasonable period, Customer may terminate the affected Order Form and receive a refund of prepaid fees for the unused terminated period.

Except for express warranties in the agreement and to the maximum extent permitted by law, the Services are provided "as is" and "as available." Truffl disclaims implied warranties of merchantability, fitness for a particular purpose, non-infringement and uninterrupted or error-free operation.

Truffl does not warrant that AI outputs will be accurate, unique or suitable for Customer's use case, or that every attempted call, integration or action will complete successfully.

19. Indemnities

19.1 Customer indemnity

Customer will defend and indemnify Truffl and its officers, directors, employees and affiliates against third-party claims, damages, penalties, costs and reasonable legal fees arising from:

• Customer Content;
• Customer's breach of Sections 7 or 8;
• Customer's failure to obtain required consent or authority;
• Customer's unlawful communications, recordings, automated decisions or tool actions; or
• Customer's infringement or violation of third-party rights.

19.2 Truffl intellectual-property indemnity

For paid Services, Truffl will defend Customer against a third-party claim that Truffl Technology, when used as authorised, infringes an Indian patent, copyright or trademark, and will pay finally awarded damages or approved settlements.

Truffl has no obligation for claims caused by Customer Content, Customer instructions, unauthorised use, modification, combination with items not provided by Truffl, continued use after notice, or Third-Party Services.

Truffl may modify or replace the affected Service, obtain continued-use rights, or terminate the affected functionality and refund prepaid fees for the unused terminated period.

19.3 Procedure

An indemnified party must promptly notify the indemnifying party, provide reasonable cooperation and allow control of the defence and settlement. No settlement may admit fault or impose non-monetary obligations on the indemnified party without consent.

20. Limitation of liability

To the maximum extent permitted by law:

1. neither party will be liable for indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, revenue, goodwill, anticipated savings or data, even if advised of the possibility; and
2. each party's total aggregate liability arising from the agreement will not exceed the fees paid or payable by Customer for the affected Services during the 12 months preceding the event giving rise to liability.

The exclusions and cap do not apply to:

• Customer's payment obligations;
• Customer's breach of acceptable-use restrictions;
• either party's fraud, wilful misconduct or liability that cannot lawfully be limited; or
• indemnity obligations to the extent expressly excluded from the cap in a signed agreement.

Free and preview Services have an aggregate liability cap of INR 10,000, to the maximum extent permitted by law.

21. Governing law and disputes

These Terms and disputes arising from them are governed by the laws of India, without regard to conflict-of-law principles.

Before filing a claim, the parties will attempt in good faith for 30 days to resolve the dispute through authorised business representatives, except where urgent injunctive relief is required.

Subject to mandatory law, the courts of competent jurisdiction in Bengaluru, Karnataka, India will have exclusive jurisdiction.

Nothing in these Terms limits non-waivable rights or remedies available under other applicable law.

22. Changes to the Services or Terms

Truffl may update these Terms for legal, security, operational or product reasons. We will post the revised Terms and update the date. Material changes affecting an active paid term will be notified as required by law or contract and will generally apply from the next renewal unless earlier application is required by law or security.

Continued use after an effective update constitutes acceptance where legally permitted. If Customer objects to a material update, it must stop using the affected Services and contact Truffl before the update takes effect.

23. General

• Notices. Legal notices must be sent to the addresses in the applicable Order Form or, for notices to Truffl, to as@trufflinnovations.in with a copy to the registered office.
• Assignment. Neither party may assign the agreement without the other's consent, except to an affiliate or in connection with a merger, reorganisation or sale of substantially all relevant assets, provided the assignee assumes the obligations. Customer may not assign to a direct competitor of Truffl without consent.
• Subcontractors. Truffl may use subcontractors and remains responsible for their performance to the extent stated in the agreement.
• Force majeure. Neither party is liable for delay caused by events beyond reasonable control, excluding payment obligations.
• Independent contractors. The parties are independent contractors. The agreement creates no partnership, agency, fiduciary or employment relationship.
• No third-party beneficiaries. No person other than the parties has rights under the agreement unless expressly stated.
• Waiver. Failure to enforce a provision is not a waiver.
• Severability. An unenforceable provision will be modified to the minimum extent necessary, and the remainder continues.
• Entire agreement. The agreement is the entire agreement concerning its subject and replaces prior discussions or representations.
• Electronic communications. You consent to receive agreements, notices and records electronically where permitted by law.

24. Contact

Oravio AI Private Limited (Truffl)
Flat No. 024, B-Block, No. 97/2, DS Max Signature,
Devinagar Main Road, Near LKR Nagar, RMV Stage 2,
Bengaluru, Karnataka - 560094, India
Email: as@trufflinnovations.in
Telephone: +91 63614 21009

Effective date: 3 September 2026
Last updated: 3 September 2026

1. About this notice

This Cookie Notice explains how Oravio AI Private Limited, operating under the brand Truffl ("Truffl", "we", "us" or "our"), uses cookies and similar technologies on its website and related online services.

It should be read with the Truffl Privacy Policy.

2. What cookies and similar technologies are

Cookies are small text files stored on a browser or device. Similar technologies include pixels, tags, local storage, software-development-kit identifiers and scripts that recognise a browser or device, remember preferences, measure activity or support advertising.

Some technologies are operated directly by Truffl. Others are operated by third parties whose services appear on or support the website.

Cookies may be:

• Session cookies, which expire when the browser closes; or
• Persistent cookies, which remain until their stated expiry or until deleted.

They may also be:

• First-party cookies, set by Truffl; or
• Third-party cookies, set by another provider.

3. Categories we use

3.1 Strictly necessary

These technologies are required for the website or service to function securely. They may support:

• login and session management;
• authentication and account security;
• load balancing and network delivery;
• fraud, abuse and bot prevention;
• saving privacy choices;
• form submission and essential error handling; and
• maintaining requested functionality.

They cannot be disabled through the consent interface because the requested service may not work without them. They should not be used for advertising.

3.2 Analytics and performance

These technologies help us understand how visitors use the website, which pages and campaigns perform, where errors occur and how the experience can be improved. They may collect page views, navigation events, referral data, approximate location, device information and pseudonymous identifiers.

Analytics technologies will remain disabled until consent where required.

3.3 Functional

These technologies remember optional choices or enable enhanced third-party features, such as embedded scheduling, video or personalised interface settings.

If a third-party embed can track visitors before interaction, it must remain blocked until the visitor consents to the applicable category or actively chooses to load it.

3.4 Advertising and retargeting

These technologies may:

• attribute visits or enquiries to campaigns;
• measure advertisement effectiveness;
• build or use audiences;
• limit advertisement frequency;
• personalise advertisements; or
• recognise a visitor across websites, applications or devices.

Information disclosed for cross-context behavioural advertising may be treated as "sale" or "sharing" under some privacy laws, even where no money is exchanged.

Advertising and retargeting technologies will remain disabled until consent where required. Visitors may reject them without losing access to the public website.

4. Consent choices

On the first applicable visit, Truffl will display a consent interface offering equally clear choices:

• Accept all
• Reject non-essential
• Manage preferences

No analytics, functional tracking or advertising/retargeting technology may activate before the required choice is recorded.

The preference centre must allow a visitor to enable or disable each non-essential category independently. Strictly necessary technologies remain active.

Consent must not be obtained through pre-ticked boxes, inactivity, scrolling or a design that makes rejection materially harder than acceptance.

5. Changing your preferences

You can withdraw or change consent at any time through the Cookie Settings link displayed in the website footer.

Withdrawing consent does not affect processing already completed lawfully. After withdrawal, Truffl must stop loading the relevant non-essential technologies and, where technically possible, delete their first-party identifiers. You may also delete cookies through browser settings.

Blocking all cookies through a browser may affect login or other essential functionality.

6. Global Privacy Control and advertising opt-outs

Where required by applicable law, Truffl will treat a recognised browser-based opt-out preference signal, such as Global Privacy Control, as a request to opt out of sale or sharing and cross-context behavioural advertising for the associated browser or device.

If Truffl becomes subject to a law requiring a separate Your Privacy Choices or Do Not Sell or Share My Personal Information link, that link must be presented in the footer and connected to the consent platform.

Truffl does not sell personal data for monetary consideration. Its use of advertising or retargeting providers may nevertheless constitute sharing, targeted advertising or a sale under certain laws.

7. Embedded content and scheduling

The website may contain embedded video, product demonstrations or scheduling functionality such as Calendly. These providers may set cookies or receive device and interaction data.

The recommended implementation is:

1. keep the embed inactive before the required consent;
2. show a privacy-preserving placeholder;
3. load the embed only after consent or an informed user action; and
4. provide a direct external link where appropriate.

Submitting Truffl's contact form and agreeing to its stated processing does not automatically constitute consent to unrelated advertising cookies.

8. Current cookies and providers

The Cookie Settings interface available in the website footer displays the current cookies and similar technologies used on the device, including their provider, category, purpose and duration. That interface forms part of this Cookie Notice and is updated when our website technologies change.

Truffl reviews its website and consent configuration when providers or functionality change. A technology will not be classified as strictly necessary merely because it is convenient for analytics or advertising.

9. Retention of choices

Truffl will retain a record of the visitor's consent or rejection for the period reasonably necessary to honour and demonstrate the choice. The recommended renewal period is 12 months, or earlier if the purposes or providers materially change.

Cookie durations must not exceed what is necessary for their stated purpose. The exact duration of each technology must appear in the cookie inventory.

10. International processing

Third-party analytics, advertising and embedded-service providers may process information in countries outside the visitor's location. Such processing is addressed in the Privacy Policy and applicable provider terms and safeguards.

11. Updates

We may update this Cookie Notice when technologies, providers, purposes or legal requirements change. The current version and date will be posted on the website. If a change materially expands non-essential processing, we will request consent again where required.

12. Contact

Questions about this notice or Truffl's use of cookies may be sent to:

Oravio AI Private Limited (Truffl)
Flat No. 024, B-Block, No. 97/2, DS Max Signature,
Devinagar Main Road, Near LKR Nagar, RMV Stage 2,
Bengaluru, Karnataka - 560094, India
Email: as@trufflinnovations.in
Telephone: +91 63614 21009

Last updated: 24 October 2026

This policy covers manual INR purchases of prepaid Truffl credit units through Razorpay Checkout. It does not replace a separately signed Order Form or applicable legal rights.

Before payment

Review the credit units, INR price, applicable GST and final payable total shown in your workspace before continuing to Razorpay. You may leave checkout before completing payment. No recurring subscription or automatic recharge is attached to this manual credit purchase.

Digital delivery and cancellation

Credit units are added to the purchasing workspace after Truffl verifies that the payment was captured. No physical product is shipped. Before payment, you may leave checkout; after payment, contact support if you need a cancellation or refund review. If confirmation is delayed, check the purchase status before trying again.

Requesting a refund

Email as@trufflinnovations.in with your workspace, purchase reference, purchase date and reason. We assess requests case by case, including whether credits have been used and the payment status. A request does not guarantee approval. We will respond within seven business days of receiving your request, including if we need more information.

After approval

For an approved request, Truffl will initiate the refund through Razorpay within seven business days after approval, to the original payment method. Your bank or payment provider controls when the money appears. Corresponding credit units may be adjusted so a refunded purchase is not also available to spend.

Failed or duplicate payments

If you were charged but the workspace has not confirmed your credits, check the purchase status in Billing before trying again. Contact support with the purchase reference so we can investigate the payment and credit record. Do not send card details, passwords or one-time codes.

Contact and other terms

This policy is provided by Oravio AI Private Limited, operating as Truffl. You can contact us at as@trufflinnovations.in or +91 63614 21009. Read our Terms of Service, Privacy Policy and digital delivery policy. Your statutory rights remain unaffected.

Last updated: 24 October 2026

This policy covers manual INR purchases of prepaid Truffl credit units for an authorised workspace. These are digital credits. No physical product is shipped.

How delivery works

After Truffl verifies payment capture, the purchased credit units are added to the purchasing workspace. A browser success screen alone does not confirm delivery. The workspace Billing view shows the purchase and credit status.

If credits are delayed

If payment appears successful but credits are not shown, check Billing before paying again. Email as@trufflinnovations.in with the workspace and purchase reference. We will investigate the provider payment and credit record. Do not send card details, passwords or one-time codes.

Cancellations and refunds

You may leave checkout before completing payment. For a payment already made, read our refund and cancellation policy to request a case-by-case review and see the response and refund initiation timelines.

Contact

Oravio AI Private Limited (Truffl) can be reached at as@trufflinnovations.in or +91 63614 21009. See our Terms of Service and Privacy Policy.