Last Updated: 4 July, 2025

This privacy policy ("Privacy Policy") is published in compliance with the applicable provisions of the Information Technology Act, 2000, and the rules made thereunder including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as well as the Digital Personal Data Protection Act, 2023 ("DPDP Act").

This Privacy Policy constitutes a legal agreement between you, the user of the Platform (defined below), and Paperstack Technologies Private Limited ("Elixir", "we", "our", or "us"), a company incorporated under the Companies Act, 2013, having its registered office at M-26, First Floor, Sham Nagar, Near Shitla Mandir, Tilak Nagar East, New Delhi - 110018.

This Privacy Policy explains how we collect, use, disclose, share, and safeguard information you provide while accessing our services through the Elixir Club mobile application, our website (https://www.joinelixir.club), and any related services (together, the "Platform").

By voluntarily providing your information and accessing or using the Platform, you agree to the terms of this Privacy Policy and expressly consent to our collection, use, disclosure, and retention of your personal data in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, you must not access or use the Platform.

1. Categories of Information Collected

During the course of your access to or use of the Platform, we may collect the following types of data:

a. Personal Data

• Name, gender, date of birth, address

• Mobile number, email address

• Government-issued identifiers such as PAN and Aadhaar (voluntarily provided)

• Other KYC-related information as mandated under Applicable Laws

b. Transactional & Card Usage Information

• Transaction history on the Elixir Card

• Fund loading details, including linked source accounts

• Refunds, reversals, and closure instructions

c. Technical and Usage Data

• Device identifiers, IP address, session logs

• Usage analytics, crash logs, and feedback metadata

• Cookie identifiers and in-app preferences

d. Location Information

• Limited to IP-level location or user-granted app-level permissions for fraud detection, where applicable

We do not collect or store biometric identifiers or sensitive card information. Any payment credentials are handled exclusively by regulated entities under PCI-DSS and RBI-compliant infrastructure.

2. Purpose and Legal Basis of Processing

The information described above shall be collected and processed for the following purposes:

• To enable onboarding, issuance, and activation of the Elixir Card (a co-branded PPI issued by LivQuik Technology (India) Private Limited)

• To comply with legal obligations under RBI PPI Master Directions and KYC/AML rules

• To manage Platform access, account preferences, and transaction visibility

• To provide customer care, resolve disputes, and manage refund/closure requests

• To carry out analytics, improve our services, and enhance user experience

• To assess suitability for, and communicate opportunities related to, potential financial products or services, including those offered by licensed financial institutions and regulated credit bureaus

You hereby expressly consent to the sharing of your personal data (including but not limited to name, mobile number, PAN, and limited usage history) with regulated financial institutions, including credit information companies, solely for the lawful purpose of evaluating and structuring potential future financial products and services.

We rely on the following legal bases:

• Your express and informed consent

• Performance of contractual obligations

• Compliance with applicable legal and regulatory obligations

• Our legitimate interests (e.g., fraud prevention, service enhancement, and financial product development)

3. Disclosure and Sharing of Information

We do not rent or sell your personal data. We may share your information with the following categories of third parties, only as required to fulfil the lawful purposes outlined above:

a. PPI Issuer and Regulatory Bodies

• LivQuik Technology (India) Private Limited for KYC, transaction processing, and compliance

• Government authorities such as RBI, UIDAI, CKYCR, FIU, or law enforcement, pursuant to applicable laws

b. Technology and Operational Service Providers

• Cloud hosting and data storage infrastructure providers

• Analytics, communication, and support tools used to operate the Platform

• Card lifecycle and program management vendors such as M2P Fintech

c. Financial Institution Partners

• Licensed banks, NBFCs, and regulated financial entities for evaluating product viability, underwriting models, and enabling pre-approved or customized financial offers to our users

• This may include sharing of limited personal data with licensed credit bureaus to conduct soft credit profiling or segment-level assessment

All such sharing is governed by appropriate contracts ensuring confidentiality, data protection obligations, and limited usage strictly for permitted purposes.

4. Processing for Prospective Financial Offerings

In the ordinary course of evaluating and facilitating the launch of new financial products, Elixir may collaborate with one or more regulated financial entities. For this limited purpose, and in accordance with your continued use of the Platform:

• We may process and share specific personal identifiers and usage insights with prospective banking partners, NBFCs, or licensed credit bureaus

• The information shared may include your name, PAN, mobile number, KYC verification status, and transaction trends

• This data may be used for evaluating the financial profile of cohorts or individuals for product development, market testing, or preliminary underwriting assessments

You hereby acknowledge and consent to such sharing of data for lawful and limited evaluation purposes by such partners, including soft credit bureau checks. No direct marketing or product issuance will take place without further consent at the point of offer.

5. Your Rights

As a data principal under the DPDP Act, you are entitled to:

• Request access to your personal data processed by us

• Request rectification of inaccurate or outdated data

• Withdraw previously granted consent for specific processing purposes

• Nominate a person to exercise your rights in the event of incapacity

• File a complaint with the Data Protection Board of India, in case of unresolved grievances

Requests may be submitted in writing to support@joinelixir.club.

6. Retention of Data

Your personal data will be retained:

• For the duration of your relationship with us and use of the Platform

• Thereafter, for a period required under applicable laws and audit requirements, typically not exceeding 8 years from date of account closure

Anonymized and aggregated data that does not reveal your identity may be retained for internal analysis and research.

7. Data Security

We are committed to maintaining appropriate technical and organizational measures to ensure:

• Secure storage in Indian data centers or under contracts with comparable jurisdictions

• Encryption of sensitive data in transit and at rest

• Restricted access and periodic audits of storage infrastructure

We do not store or process payment card data and are not PCI-DSS certified. Payment authentication and processing is facilitated via regulated partners only.

8. International Transfers

We endeavor to store personal data in India to the extent feasible. Any international transfers, if required for technical processing, shall be made in compliance with DPDP Act safeguards and shall be subject to data transfer agreements or similar protections.

9. Updates to this Policy

We reserve the right to revise this Privacy Policy at any time. Significant changes will be communicated through email or app notification. Continued use of the Platform after such updates shall constitute your acceptance.

10. Grievance Officer

In accordance with the DPDP Act and Information Technology Act, 2000, you may contact our designated Grievance Officer:

Name: Ritik Madan
Email: support@joinelixir.club
Phone: +91-8765534151
Address: M-26, First Floor, Sham Nagar, Near Shitla Mandir, Tilak Nagar East, New Delhi - 110018

We will acknowledge your complaint within 48 hours and endeavor to resolve the same within 30 days of receipt.

11. Acceptance

By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to be bound by the terms of this Privacy Policy.

© 2025 Paperstack Technologies Private Limited. All Rights Reserved.