Maasi — operated by Elephant in the Room Infotech Private Limited
CIN: U63120KA2025PTC202307
Registered office: 431/A, HSR Layout, Bengaluru, Karnataka 560102

Version 1.0

Effective date: This Policy takes effect for each Client from the date that Client signs up on the Platform. The version in force on your sign-up date governs your engagement, and continues to govern it even if this Policy is later amended, except as set out in clause 36.

Part A — Foundations

1. Scope

1.1 Who we are. Elephant in the Room Infotech Private Limited (the "Company", "we", "us"), operating under the brand Maasi, is the Data Fiduciary for the personal data described in this Policy. We decide why and how that data is processed, and we are accountable for it.

1.2 What this Policy covers. All personal data we process through www.mymaasi.com, the Maasi mobile applications, our WhatsApp and telephone channels, and our offline operations (together, the "Platform"), in connection with the Day Nanny, 24×7 Nanny, Japa, Governess and Instant Nanny services (each, a "Service").

1.3 The law we work to. This Policy is written to comply with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025), the Information Technology Act, 2000 and the rules made under it, the Consumer Protection (E-Commerce) Rules, 2020, and the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 where relevant.

1.4 Ahead of the deadline. Full statutory compliance under the DPDP Rules, 2025 is required by 13 May 2027. We have chosen to operate to these standards from launch rather than waiting for that date. Where a provision of this Policy is stricter than what the law currently compels, we still treat it as binding on us.

1.5 Why we take this seriously. We handle the home addresses, daily routines and photographs of small children, and the identity documents of women who work in people's homes. This is among the most sensitive combinations of data any consumer business in India holds. This Policy is written on that basis.

1.6 Relationship with other documents. Each Client executes a service contract (the "Service Contract"). Where this Policy and an executed Service Contract conflict on a data protection matter, this Policy prevails, because it reflects statutory obligations that a contract cannot displace. On commercial matters the Service Contract prevails, as set out in the Cancellation and Refund Policy.

2. Definitions

3. Who to contact about your data

This contact is published in accordance with Rule 9 of the DPDP Rules, 2025. You may write to us in English, Hindi or Kannada, and we will reply in the language you wrote in.

4. How this Policy is organised

Four groups of people have data with us, and every piece of personal data we hold belongs to exactly one of them. Part B deals with each group once. Parts C to G then apply across all four.

4.1 Anything not expressly addressed is governed by clause 33.

Part B — Whose data we handle

5. Clients — parents and guardians

5.1 What we collect.

5.2 What we do not collect from you. We do not collect your Aadhaar number, PAN, bank account number, card number, caste, religion, political opinion, or sexual orientation. Where a field on any form appears to ask for these, do not provide them.

5.3 Call recording. Calls to and from our team may be recorded for quality and dispute resolution. You are told at the start of the call and may ask us not to record.

6. Children

6.1 Legal position. Under the DPDP Act a Child is anyone under 18. Processing a Child's personal data requires verifiable consent from the parent or lawful guardian. In our case the parent or guardian is the Client and the account holder, and gives that consent directly at registration.

6.2 What we collect.

6.3 Health information about a Child is collected only where you provide it, is shared only with the assigned caregiver and our Delight and Quality team, and is deleted when the engagement ends unless you ask us to retain it for a subsequent engagement.

6.4 What we never do with a Child's data. In accordance with Section 9 of the DPDP Act and Rule 10 of the DPDP Rules, we do not:

• track, monitor or profile a Child;
• carry out behavioural analysis or build any behavioural profile of a Child;
• direct advertising at a Child, or use a Child's data for any advertising or marketing;
• share a Child's data with any advertiser, data broker, analytics provider or model-training provider; or
• use a Child's photograph in any marketing material, on our website, or in any social media post, whatever the setting on your account.

6.5 Minimisation. We ask for a Child's first name only. We do not require a surname, school name, or date of birth beyond the age needed for matching.

6.6 A Client who is a minor. Our Services are for adults. If we learn that an account holder is under 18, we suspend the account and delete the data, other than what we must retain to record that we did so.

7. Caregivers

Caregivers are Data Principals in their own right, and their data is protected on the same terms as yours.

7.1 What we collect from a caregiver. Identity and proof of address, photograph, verification results, employment and reference history, training and assessment records, bank details for disbursing her Service Fee, health declarations relevant to her fitness for the work, and her deployment history.

7.2 What we share with you. Before you select a caregiver, we share a profile: her first name, age, experience, languages, skills, training record, and the outcome of verification steps completed. We do not share her identity documents, her document numbers, her home address, her bank details, her family details, or her personal contact number.

7.3 After selection. We share her full name and a contact number for the engagement. We share her residential address only where the Service requires it and she has agreed.

7.4 Your obligations towards her data. Anything you learn about a caregiver through us is given to you for the purpose of the engagement only. You may not publish it, share it in parent groups or on social media, pass it to another agency, or use it to contact her outside the engagement. This obligation survives the end of the engagement.

7.5 Ratings and feedback. Feedback you give about a caregiver is used for quality and training. It is shared with her in substance so that she can respond, but not attributed to you where you ask for that.

8. Others

8.1 Website visitors and enquirers. Contact details you submit through a form, the serviceability checker, or a WhatsApp enquiry, together with the technical data in clause 27. Retained for 12 months if you do not register.

8.2 Job applicants. Name, contact, CV and interview notes for roles at the Company. Retained for 12 months after a decision, unless you ask us to keep it longer for future roles.

8.3 Referees. Where a caregiver names a former employer as a reference, we hold that person's name, contact and the reference given, for the duration of the caregiver's association with us.

8.4 People who are not our customers. If someone who has never used Maasi believes we hold their data, they may write to privacy@mymaasi.com and exercise every right in Part G.

Part C — Why we process, and on what basis

9. Purposes and legal basis

We process personal data only for the purposes below. Each is tied to the basis on which we are permitted to do so under the DPDP Act.

9.1 Purpose limitation. We do not use personal data for any purpose not listed above. If we want to use it for a new purpose, we will ask you again, with a fresh notice.

10. Consent

10.1 Consent is asked for at the point of collection, through a standalone notice in plain language that says what data is being collected and for what specific purpose, as required by Section 5 of the DPDP Act.

10.2 Consent is never bundled. Agreeing to our Terms of Service is not treated as consent to marketing, and declining marketing does not affect your Service.

10.3 You may withdraw consent at any time, as easily as you gave it. Clause 24 sets out how, and what follows.

10.4 Consent Managers. Registration of Consent Managers under the DPDP Rules opens from 13 November 2026. Our systems are being built to accept and honour consent instructions routed through a registered Consent Manager once that framework is live.

11. Legitimate uses without consent

The DPDP Act permits processing without consent in a narrow set of situations. We rely on this only for:

• responding to a medical emergency or a threat to the life or safety of a Child, a Client or a Caregiver;
• complying with a law, a court order, or a lawful request from a public authority; and
• establishing, exercising or defending a legal claim.

We do not rely on any other legitimate use.

12. What we never do

12.1 We do not sell personal data. We have never sold it and will not sell it.

12.2 We do not rent, trade or licence personal data to advertisers, data brokers or list vendors.

12.3 We do not use your data, a Child's data, or a caregiver's data to train any artificial intelligence model, our own or a third party's, except on data that has been fully de-identified so that no individual can be identified from it.

12.4 We do not run behavioural advertising, and we do not embed third-party advertising trackers on the Platform.

12.5 We do not make any decision about you, or about a caregiver, by automated means alone where that decision has a significant effect. Matching is assisted by software and confirmed by a person.

Part D — Who we share with

13. The caregiver assigned to you

13.1 The assigned caregiver receives your name, Service Address, contact number, the Child's first name and age, the routine and health notes you have provided, and the agreed Scope of Work.

13.2 She receives your address only after you have selected her. Shortlisted caregivers who have not been selected receive your locality, not your address.

13.3 Caregivers are bound by a written confidentiality undertaking covering everything they learn in your home. That undertaking survives the end of the engagement.

14. Service providers

We use third parties to run the business. Each is a Data Processor, is bound by a written agreement, may process data only on our instructions, and may not use it for its own purposes.

4.1 A current list of categories of Data Processors is available on request from privacy@mymaasi.com.

15. Authorities and legal disclosure

15.1 We disclose personal data to a court, police, tax authority, labour authority or other public authority where we are compelled to by law, or where disclosure is necessary to respond to a threat to safety.

15.2 We satisfy ourselves that the request is lawful, disclose only what is asked for, and record every disclosure.

15.3 We tell the affected person that a disclosure has been made, unless the law forbids us from doing so.

16. Business transfer

16.1 If the Company is acquired, merges, or transfers a business line, personal data may transfer as part of that transaction. The acquirer will be bound by this Policy in respect of data transferred, and you will be notified before any transfer takes effect.

17. Nobody else

17.1 Beyond clauses 13 to 16, we share personal data with no one. In particular we do not share it with other parents, other caregivers, other agencies, marketing partners, or any affiliate for its own use.

Part E — Where data is stored, and for how long

18. Storage and cross-border transfer

18.1 Personal data is stored on servers located in India.

18.2 Some of our Data Processors operate infrastructure or support functions outside India. Where that results in a transfer, we transfer only what is necessary, under contractual protections, and only to countries not restricted by the Central Government under Section 16 of the DPDP Act.

18.3 The Central Government has not yet notified the list of restricted countries. We monitor this and will stop any transfer that becomes restricted.

18.4 A Child's personal data is not transferred outside India in any circumstance.

19. Retention and erasure

19.1 The principle. We keep personal data only for as long as the purpose it was collected for is still being served, and erase it when that purpose ends, as required by Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules.

19.2 How long we keep things.

19.3 Notice before erasure. Where data is due to be erased because you have not engaged with us, we give you at least 48 hours' notice before erasing it, so you can act if you want to keep the account.

19.4 Where the law requires us to keep something longer than the table above, we keep it for that longer period and for no other purpose.

19.5 The default retention periods in the Third Schedule to the DPDP Rules apply to certain large platforms. We are below those thresholds, and have set our own periods above rather than defaulting to the maximum the law would allow.

Part F — How we protect data

20. Security safeguards

20.1 We implement the safeguards required by Rule 6 of the DPDP Rules, which include:

• encryption of personal data in transit and at rest;
• access control, so that a member of our team can see only the data their role requires;
• masking of identity documents and payment references;
• logging of access to personal data, retained for 12 months;
• multi-factor authentication for staff access;
• contractual and technical controls over Data Processors; and
• regular review of access rights, particularly when someone leaves.

20.2 Who inside Maasi can see what. The matching team sees requirements and locality. The assigned caregiver sees what clause 13.1 describes. The Delight and Quality team sees engagement and incident records. Finance sees payment records. No single role sees everything, and access to a Child's health notes is limited to the assigned caregiver and the Quality team.

20.3 Caregivers, employees, interns and contractors sign confidentiality undertakings and are trained on data handling before they are given access.

20.4 No system is perfectly secure. We do not claim otherwise. What we commit to is the safeguards above, and the response in clause 21.

21. If there is a breach

21.1 On becoming aware of a personal data breach we will:

• inform every affected Data Principal without delay, in plain language, describing what happened, what data was involved, what the likely consequences are, what we have done about it, and what you should do;
• report the breach to the Data Protection Board of India within 72 hours of becoming aware of it, with the particulars the Rules require; and
• give the Board updated information as our investigation progresses.

21.2 We do this for every breach. The DPDP framework sets no materiality threshold, and we do not apply one of our own.

21.3 Where a breach involves a Child's data, we will also tell you what specific steps we are taking to protect that Child, and we will do so before we make any public statement.

21.4 You can report a suspected breach to privacy@mymaasi.com at any time. We acknowledge within 48 hours.

Part G — Your rights and choices

22. Your rights

Under the DPDP Act you have the following rights. Each is free of charge.

22.1 A Child's rights are exercised by you as parent or guardian. You may access, correct or delete everything we hold about your Child.

22.2 A caregiver's rights are hers to exercise. You cannot exercise them on her behalf, and we will not act on a request from you concerning her data.

23. How to exercise a right

23.1 Write to privacy@mymaasi.com from your registered email address, or use the privacy section of the Maasi app. Say which right you are exercising.

23.2 We acknowledge within 48 hours and respond substantively within 30 days.

23.3 We may ask you to verify your identity, and we ask for no more than is needed to do so.

23.4 Where we cannot do what you have asked — because a law requires us to retain something, or the request concerns another person's data — we say so in writing, with the reason.

23.5 Your duties as a Data Principal. The DPDP Act asks you to give authentic information and not to raise false or frivolous complaints. We ask the same.

24. Withdrawing consent

24.1 You may withdraw consent for any processing at any time, through the app, or by writing to privacy@mymaasi.com.

24.2 Withdrawal takes effect for the future. It does not undo processing already carried out on the basis of consent lawfully given.

24.3 We will tell you plainly what withdrawal means in practice. Withdrawing consent for us to hold your Service Address, for instance, means we cannot deliver the Service, and the engagement will end. Withdrawing marketing consent has no effect on the Service at all.

24.4 Withdrawal does not affect data we are required by law to retain, or data needed to defend a legal claim.

25. Nomination

25.1 You may nominate a person to exercise your rights on your behalf in the event of your death or incapacity, by writing to privacy@mymaasi.com. You may change or revoke a nomination at any time.

26. Communications and marketing

26.1 Service communications — booking confirmations, caregiver updates, invoices, incident notifications, policy changes — are part of the Service. You cannot opt out of these while an engagement is running.

26.2 Marketing communications — offers, newsletters, new service announcements — require separate consent, given at registration or later, and are sent only on WhatsApp or email.

26.3 Every marketing message carries a means of opting out. Opting out takes effect within 7 days and does not affect your Service.

26.4 We comply with TRAI's regulations on commercial communications and honour DND registration.

26.5 We never send marketing to a caregiver's number that she gave us for work purposes, and we never send marketing about a Child.

27. Cookies and tracking

27.1 On our website we use cookies and similar technologies that are strictly necessary for the site to function, and cookies that measure how the site is used in aggregate.

27.2 We do not use advertising cookies, retargeting pixels, or cross-site trackers.

27.3 You can block or delete cookies through your browser. Blocking the strictly necessary ones may stop parts of the site working.

27.4 In the app we collect device type, operating system version, app version, crash reports and usage events. We do not collect your contacts, photos, precise background location, microphone or camera data, except where you actively use a feature that needs it and grant permission.

27.5 No tracking of any kind is applied to a Child.

Part H — Special situations

28. Additional safeguards for a Child's data

28.1 Clause 6 sets out what we collect. This clause sets out the controls that sit on top.

28.2 A Child's data is stored separately from marketing and analytics systems, and is technically excluded from them.

28.3 A Child's data is never used in a case study, testimonial, investor material, or press communication, even in anonymised form, without your separate written consent for that specific use.

28.4 Where you ask us to delete a Child's data, we do so within 7 days, retaining only what a law compels us to keep.

28.5 We do not verify a Child's age independently. We rely on you, as parent or guardian, to tell us truthfully.

29. Identity documents and Aadhaar

29.1 We verify caregiver identity. Where Aadhaar is used, we use it only for offline verification or through a lawful authentication mechanism, with the caregiver's consent.

29.2 We do not store Aadhaar numbers. We retain only a masked reference and the verification outcome.

29.3 We never share a caregiver's Aadhaar data, identity document, or document number with a Client, in any form, at any stage.

29.4 Aadhaar is never collected from a Client or a Child.

29.5 Where a caregiver declines Aadhaar-based verification, we offer alternative documents. Verification is not conditioned on Aadhaar.

30. Background verification

30.1 Verification of a caregiver may include identity, address, reference checks, and police verification where available in her home state.

30.2 Verification is initiated on selection and may conclude after the caregiver has started. We describe this accurately rather than claiming that every check is complete before day one.

30.3 We share the outcome of verification with you, not the underlying report, documents or numbers.

30.4 An adverse outcome is acted on immediately under the Cancellation and Refund Policy, and the caregiver is told what was found and given a chance to respond.

30.5 Verification data is never used for any purpose other than assessing suitability for placement.

31. Cameras and recording in your home

31.1 Many families use cameras at home. If you record or monitor a caregiver in your home, you are responsible for that processing, not us. We are not the Data Fiduciary for your camera footage.

31.2 We require that you tell the caregiver, before her first day, that cameras are in use and where they are. This is a condition of the engagement.

31.3 Cameras must never be placed in a bathroom, in a room used by a live-in caregiver for sleeping or changing, or anywhere she would reasonably expect privacy. Placing one there is a material breach of the Service Contract and we will withdraw the caregiver.

31.4 We do not ask for, access, or store your camera footage. If you send us footage in connection with an incident, we hold it only for that incident and delete it when the matter closes.

32. AI features

32.1 The Platform offers an AI assistant. Conversations with it are processed by a third-party AI provider acting as our Data Processor.

32.2 Conversations are used to answer your question and to improve our own service quality. They are not used to train the provider's models.

32.3 Do not enter a Child's health information, identity document details, or payment details into the AI assistant. It is not designed for that, and our other channels are.

32.4 Any decision that affects your engagement — matching, replacement, refund, termination — is made by a person, not by the assistant.

Part I — General

33. Situations not expressly covered

33.1 Where a data protection question is not addressed by any clause of this Policy, the following default applies: we will process no more data than the purpose requires, seek consent before doing anything new with it, and answer your question in writing within the timelines in clause 23.

33.2 Where the same question recurs, it will be written into this Policy at the next version.

33.3 Clause 33.1 does not override any express clause of this Policy or any obligation the law places on us.

34. Grievances and escalation

34.1 Raise a data protection complaint with the Grievance Officer at gargi@mymaasi.com, or with privacy@mymaasi.com. We acknowledge within 48 hours and resolve within 30 days.

34.2 Complaints may also be sent to founders@maasi.ai, which reaches the founders directly.

34.3 If you are not satisfied with our response, you may complain to the Data Protection Board of India, which has been operational since 13 November 2025 and can be approached directly.

34.4 Nothing in this Policy limits any right you have under the DPDP Act, the Consumer Protection Act, 2019, or any other law that cannot be excluded by agreement.

35. Children of the Company's own staff and other exclusions

35.1 This Policy covers personal data processed in connection with the Services. Employee and internal HR data is governed by the Company's internal HR privacy notice, available to employees.

36. Changes to this Policy

36.1 The version in force on the date you sign up governs your engagement.

36.2 Where a change is material — a new purpose, a new category of recipient, a longer retention period — we give at least 15 days' notice by email and in-app notice, and where the law requires it, we ask for fresh consent rather than assuming it.

36.3 Every version is dated and archived. You may request the version applicable to your engagement at any time.

37. Governing law

37.1 This Policy is governed by the laws of India.

37.2 Disputes are subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka, without prejudice to your right to approach the Data Protection Board of India.

37.3 If any provision is held invalid or unenforceable, it is severed and the rest continues in full force.

38. Contact

Data protection: privacy@mymaasi.comGrievance Officer: Gargi Pandey — gargi@mymaasi.comFounders: founders@maasi.aiElephant in the Room Infotech Private Limited, 431/A, HSR Layout, Bengaluru, Karnataka 560102
CIN: U63120KA2025PTC202307

Read alongside our Terms of Service, Cancellation and Refund Policy, and Shipping and Delivery Policy.