privacy | OLREADY

1 Who is responsible and what this notice covers This Privacy Policy explains how OLREADY collects, uses, shares and retains personal information for its artist-plan website, Pro and Phoenix purchases, invitation requests, onboarding, signing, public artist features and support. The responsible operator is Kanika Khanna, sole proprietor trading as Katalyst Infomedia and operating the OLREADY brand ("OLREADY", "we", "us" or "our"). Business address: 2nd Floor, SCO 198–199, Next 57 Coworking, Sector 17C, Chandigarh, Chandigarh 160017, India. For privacy questions, email care@olready.in. This notice covers information handled through these activities and the corresponding handoff to OLREADY’s merchant service. Other services or third-party sites may give additional notices for their own processing. Where additional information is collected in a different service, the notice supplied there also applies. This policy is a notice about information handling. It does not create a refund, revenue assurance or other commercial plan entitlement. Optional processing requiring consent is not authorised merely by accepting purchase terms. 2 Business transition and legacy customer records OLREADY was previously managed by KSM Beauty Pvt Ltd, registered at SCF 342, Motor Market, Manimajra, Chandigarh 160101. Katalyst Infomedia has taken over operation of the brand, including transferred client relationships, running plans, assets, rights and outstanding deliverables. To administer those obligations, relevant legacy records may include customer and merchant profiles, contact details, plan and payment history, agreements, permissions, booking records and pending service or grievance information. Katalyst Infomedia handles the records it receives for continuity of the service, fulfilment of the transferred obligations and other lawful purposes described in this notice. The business transition is not fresh consent to unrelated marketing, public disclosure or a new data-use purpose. Existing opt-outs and relevant restrictions must be respected. Where notice, consent or another legal condition is required for a transfer or new use, it must be satisfied. You may contact the current privacy contact about the transferred records without resubmitting your entire plan application. 3 Information you provide Contact and enquiry information may include your name, email address, phone number, city, message, requested callback and communication preferences. Artist and business information may include your professional name, profile link, services, service locations, portfolio, biography, Instagram handle and authorised business contact details. Purchase and contract records may include the selected plan, coupon, price, GST and billing details, order and payment references, transaction status, payment-method category, invoice, refund records, onboarding details, activation dates and the signed agreement. Zoho Sign may process identity, authentication, timestamp, device and audit-trail information for signing. Support and service records may include communications, lead IDs, event details, relevant contact-attempt evidence, reversal requests and booking confirmations needed to administer a plan or assurance. Public artist features may include authorised photographs, videos, testimonials and stated booking-value results. Provide only information needed for the relevant purpose. Do not send payment passwords, OTPs, card security codes, UPI PINs or unnecessary identity documents. Redact unrelated personal information from screenshots and booking evidence. If you submit information about another person, you must have the appropriate authority or lawful basis to do so. 4 Information collected through technology Our website and service providers may process technical information such as IP address, browser and device information, request timestamps, error records and security events to deliver and protect the service. Essential cookies or similar browser storage may preserve sessions, security controls, consent choices and shopping-cart state. Where you permit optional analytics, we may record page visits, interaction events, referral information and a session identifier to understand how visitors use the website and where checkout is abandoned. Optional analytics is separate from essential transaction and security records. Cookies and browser storage are described further below. Public search-engine indexing of an approved profile is separate from an advertising pixel or behaviour-tracking technology. 5 Why we use information We use relevant information to answer enquiries and requested callbacks; set up and administer artist services; prepare and sign agreements; verify and reconcile payments; issue invoices and refunds; manage plan access; provide relationship-manager support; and assess lead reversals. We also use information to prevent misuse and fraud, secure accounts, investigate disputes, maintain records required by law and improve the website using appropriately permitted analytics. Approved profile and testimonial information is used for the publication or promotion for which permission was obtained. We send optional offers, newsletters and promotional follow-ups where you have opted in or where otherwise lawfully permitted. A request for a specific callback permits a response to that request; it is not blanket consent to unrelated marketing. Purchase acceptance does not by itself subscribe you to promotional campaigns. Processing takes place with your consent where required, and for other grounds permitted by applicable Indian law, including relevant transaction, legal-compliance and dispute-handling requirements. Optional consent may be refused without preventing unrelated services; information necessary for a purchase or signing process may be required to provide that particular service. 6 Enquiries and information shared with artists OLREADY’s enquiry service connects prospective makeup clients with relevant artists. Where the enquiry service is used, relevant client contact details and event requirements may be shared with participating artists for responding to the request, under the notice and permissions applicable when the enquiry is collected. Artists must use lead information only for the relevant professional enquiry and resulting booking, keep it secure, respect contact preferences and not resell it or add it to unrelated marketing lists. An artist separately handling a client’s own service booking is responsible for that artist’s processing and communications. For lead verification, reversal checks or booking-value verification, we may exchange limited relevant information with the client and artist. We do not need unrelated chat history or unrestricted access to your contacts. 7 Public profiles testimonials and search engines Approved public artist pages may display your name, city, biography, services, authorised media, social handle and OLREADY profile link. Approved success stories may display the specifically authorised performance figures and testimonial material. These pages are public and may appear in search-engine results, including name, city and service searches. Search engines and visitors may cache or share public content. We do not publish private payment records, phone numbers or email addresses merely because a person appears in an imported customer list. Purchasing a plan or having been a previous customer does not by itself grant permission to publish a testimonial, private financial information or third-party photographs. Contact us to correct a profile or request withdrawal of permission for optional promotional use. We will assess and action the request, but cannot guarantee immediate removal of independent third-party caches or copies. 8 Service providers and other recipients We share information only as reasonably needed for the stated purpose with authorised staff, relevant relationship managers and service providers supporting our operations. These providers may include hosting, database, media storage, email delivery, payment, signing and customer-support services. The website uses or is configured to use Vercel for hosting and Supabase for database, authentication and storage. Razorpay handles payment processing where checkout is enabled, and Zoho Sign handles agreement signing. Where configured, Resend supports email delivery and OpenAI supports AI responses. A configured integration does not necessarily mean it is enabled for every visitor or transaction. Payment providers process payment credentials through their own interfaces. OLREADY receives transaction information needed for verification, reconciliation and support; we do not request your card security code, UPI PIN or payment OTP through our forms or support channels. We may disclose information to professional advisers, tax authorities, regulators or law-enforcement bodies where legally required or reasonably necessary to establish, exercise or defend lawful rights. In a business transfer, relevant records may be transferred with appropriate confidentiality, notice and legal safeguards. We do not sell contact lists to unrelated advertisers. Some providers act on our instructions; others, such as payment networks, process information for their own legal and operational obligations. Their own notices explain that processing. We remain responsible for our own obligations. 9 AI chat browser voice and communications If AI assistance is enabled, the message you submit and relevant conversation context may be sent to OpenAI to generate a response, together with approved business information needed to answer. Do not provide sensitive personal information, payment credentials or confidential client material in the sales assistant. AI output may be inaccurate; ask the team to verify important plan or payment information. If you choose a browser microphone feature, your browser or its speech provider may process audio to produce text. Microphone permission is separate from permission to send a message. Review the text before submitting it. Read-aloud features may use the browser or device speech service. Disabling voice does not prevent use of text chat. This notice does not treat all calls as recorded. If a recording feature is introduced or used, an appropriate notice and any required consent must be provided before recording. Third-party voice or AI processing may take place outside India depending on the selected provider. Choosing a WhatsApp link opens WhatsApp and any prefilled message. Your interaction is then also subject to WhatsApp’s own terms and privacy notice. We use the information you share there to respond and maintain relevant service records. 10 Cookies analytics and marketing choices Essential cookies and storage support functions such as security, sessions, consent preferences and checkout state. Optional analytics is used only according to your applicable choices. You can revisit Cookie Preferences through the website footer and change the optional settings made available there. Blocking essential storage in your browser can prevent some functions from working. Withdrawing optional analytics consent stops future optional collection under that setting; it does not automatically erase lawfully retained transaction or security records. If advertising pixels, remarketing, session replay or additional trackers are introduced, their purpose and recipients must be disclosed and required controls provided before collection begins. This policy is not blanket permission to enable undisclosed tracking. You can unsubscribe from marketing emails through the unsubscribe mechanism or contact care@olready.in to change promotional contact preferences. Service messages about a purchase, signing, security or a requested support matter may continue when necessary. Abandoned-cart promotions will follow the applicable marketing permissions and opt-out choices. 11 Retention and international processing We retain information only for as long as reasonably necessary for the purpose for which it was collected, applicable legal obligations and the establishment or defence of claims. The period depends on the record type rather than one uniform duration for all information. Purchase, invoice, tax, refund and accounting records are retained for the applicable statutory period. Agreements, signature evidence, activation records and consent records may be retained while the relationship continues and for relevant legal or dispute periods. Lead and reversal evidence is retained while needed to deliver or review the service and resolve claims. Optional marketing records are reviewed when you opt out, with limited suppression records retained to honour that choice. Public profile content is reviewed when permission is withdrawn or the feature ends. Technical logs and analytics are retained only for the operational period reasonably needed. When information is no longer required, we delete it, anonymise it or restrict its use as appropriate. Backups may remain until their normal secure replacement cycle, and legal holds may delay deletion of relevant records. Providers may store or process information in India or other countries according to their service configuration. We do not promise that all information remains in India. We apply appropriate contractual and other safeguards and comply with applicable restrictions on transfers. 12 Security and your requests We use reasonable technical and organisational measures appropriate to the information and service, including access restrictions and protections supported by our service providers. No website or transmission method can guarantee absolute security. Suspected unauthorised access or disclosure should be reported to care@olready.in promptly. You may contact us to ask about your information, request access or correction, seek deletion where appropriate, withdraw optional consent or raise a privacy grievance. We may reasonably verify identity before disclosing or changing records. We will explain where a request cannot be fully met because information is needed for a lawful obligation or unresolved claim. Rights and response obligations provided by applicable law are honoured as those provisions take effect. Where applicable, this includes rights concerning information about processing, correction, erasure, grievance redressal and nomination under Indian data-protection law. This policy does not suggest that provisions with a future commencement date are already enforceable. Withdrawal of optional consent does not affect the lawfulness of earlier processing. If information necessary to provide a requested service cannot be processed, we will explain the resulting limitation; withdrawal does not automatically cancel an activated plan or override lawful retention duties. Requests are subject to proportionate identity and authority checks. We may decline or limit disclosure where required to protect another person’s information, security controls, confidential business material or legal privilege, as permitted by law. Account deletion or consent withdrawal does not require destruction of records lawfully needed for taxation, fraud prevention, payment disputes, contract enforcement or legal claims. 13 Children contact and updates Artist-plan purchases and accounts are intended for adults aged 18 or older. Do not submit a child’s personal information through the sales assistant or enquiry forms. If you believe we have collected a child’s information without appropriate authority, contact us so that we can investigate and take appropriate action. Images of children must not be submitted for publication without the necessary rights and permissions. Email: care@olready.in. Phone and WhatsApp: +91 86998 89901. Office hours: Monday to Saturday, 10:00 am to 6:30 pm IST. Grievance Officer: Sanyam Tayal, IT & Grievance Officer. Email: Tayalsanyam@gmail.com. Phone: +91-7009191914. Postal address: 2nd Floor, SCO 198–199, Next 57 Coworking, Sector 17C, Chandigarh, Chandigarh 160017, India. Formal privacy grievances will be acknowledged within 48 hours and handled within the applicable legal period. Where verification or additional information is reasonably necessary, we will explain what is required. Contact us using the details above. We may update this policy to reflect service or legal changes and will publish the updated date. Where a new use requires fresh notice or consent, we will provide it before that use. A policy update alone is not consent to a new optional purpose. 14 Governing law and jurisdiction This policy is governed by Indian law. For civil proceedings concerning this policy, where a valid jurisdiction agreement applies, courts of competent jurisdiction at Chandigarh, India shall have exclusive jurisdiction to the fullest extent permitted by law. This does not restrict a complaint to a competent statutory authority, criminal or cybercrime reporting, or any jurisdiction or remedy that cannot lawfully be excluded.