Legal Disclaimers & Regulatory Compliance

1. General Disclaimer

This website, IPOLabs (accessible at ipo-labs.com and all associated subdomains), is owned, operated, and maintained by IPOLabs AI Private Limited ("IPOLabs", "the Company", "we", "us", or "our"), a company incorporated under the Companies Act, 2013 and registered with the Registrar of Companies, Mumbai, Maharashtra, India.

By accessing, browsing, or using this website and/or any of its services, applications, tools, or content (collectively, "Services"), you ("User", "you", or "your") acknowledge that you have read, understood, and unconditionally agree to be bound by these Legal Disclaimers & Regulatory Compliance terms, our Privacy Policy, and our Terms of Use. If you do not agree, you must immediately cease all use of the Services.

The information, data, analyses, articles, reports, tools, and other materials available on this website are provided on an "AS IS" and "AS AVAILABLE" basis, strictly for general informational, educational, and research purposes only. Nothing contained herein constitutes, or shall be construed as constituting, an offer, solicitation, recommendation, endorsement, or advice to buy, sell, hold, or deal in any security, financial product, or investment instrument.

This document is governed by and construed in accordance with the laws of India. Any dispute arising hereunder shall be subject to the exclusive jurisdiction of the courts located in Mumbai, Maharashtra.

2. SEBI Disclosures & Securities Market Compliance

2.1 Registration Status

IPOLabs AI Private Limited is NOT a SEBI-registered Investment Adviser (IA), Research Analyst (RA), Stock Broker, Portfolio Manager, Merchant Banker, or any other category of intermediary registered with the Securities and Exchange Board of India ("SEBI") under the SEBI Act, 1992 or any regulations framed thereunder. We do not hold any SEBI registration number.

The Company operates as a technology platform providing software tools for document management, compliance workflow automation, and informational resources related to the Indian Initial Public Offering (IPO) ecosystem. We do not provide investment advisory services, portfolio management services, or research analyst services as defined under SEBI regulations.

2.2 Standard Market Risk Warning

2.3 SEBI Circular — February 2026 (EoDI Social Media Disclosures)

In compliance with the spirit of SEBI Circular No. HO/(79)2026-MIRSD-PODMMC dated 26 February 2026 ("Ease of Doing Investment — Disclosure of Registered Name and Registration Number by SEBI Regulated Entities and their Agents on Social Media Platforms"), effective 1 May 2026, we hereby confirm:

• IPOLabs AI Private Limited is not a SEBI-regulated entity and therefore is not subject to the mandatory registration number disclosure requirements prescribed under this circular.
• Any securities market-related content published by us on social media platforms (including but not limited to YouTube, Instagram, X/Twitter, LinkedIn, Facebook, Telegram, and WhatsApp) is informational and educational in nature only and does not constitute investment advice, research reports, or recommendations.
• Users are strongly advised to verify the SEBI registration status of any entity providing financial advice through social media by consulting the official SEBI Intermediary Search portal at https://www.sebi.gov.in.
• We do not impersonate, represent, or associate ourselves with any SEBI-registered intermediary, and any such representation by third parties is unauthorized and should be reported immediately.

3. Stock Exchange Disclaimers (NSE & BSE)

3.1 Exchange Data Restrictions

Any market data, index values, stock prices, historical data, or other exchange-proprietary information displayed on this website is sourced from publicly available sources and/or third-party data providers, and is provided for informational purposes only. We make no representations regarding the accuracy, completeness, timeliness, or reliability of such data.

Prohibited Activities: The scraping, crawling, systematic downloading, redistribution, republication, retransmission, or commercial use of any exchange-proprietary data accessible through this website is strictly prohibited without the prior written consent of the respective stock exchange. Any unauthorised use may constitute a violation of the intellectual property rights of NSE, BSE, and/or their data licensors, and may result in civil and/or criminal liability.

3.2 No Exchange Endorsement

The listing of any security, the display of any index value, or the mention of any exchange-related term on this website does not imply any endorsement, verification, or approval by NSE, BSE, or any regulatory body. Users should independently verify all information through official exchange websites and SEBI-registered intermediaries.

4. DRHP & IPO-Specific Warnings

• Any DRHP-related content, summaries, analyses, or tools provided on this platform are for educational and informational purposes only.
• DRHP documents may contain forward-looking statements that involve risks and uncertainties. Actual results may differ materially from those anticipated in such statements.
• Users must refer to the official DRHP filed with SEBI (available on the SEBI website and the websites of the lead merchant bankers) for the complete, authorised, and current version of any prospectus document.
• The Company's DRHP Builder tool is a workflow automation and document management tool and does not substitute for the professional services of SEBI-registered merchant bankers, legal advisors, or chartered accountants.
• Any financial projections, valuation models, or readiness assessments generated by the platform are indicative only and should not be relied upon as the sole basis for any business, legal, or financial decision.

5. No Investment Advice (DYOR Clause)

Users should always consult with qualified, SEBI-registered professionals — including investment advisers, research analysts, chartered accountants, company secretaries, and legal counsel — before making any investment, financial, or business decision. Past performance, whether real or simulated, does not guarantee or indicate future results.

The Company, its directors, officers, employees, and agents shall not be liable for any investment decisions made by users based on the information provided on this platform.

6. Data Privacy — DPDPA (India) Compliance

IPOLabs AI Private Limited operates as a "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act") read with the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and is committed to protecting the personal data of all users in accordance with the Act and Rules.

6.1 Lawful Basis for Processing

We process personal data only on the basis of: (a) explicit, free, specific, informed, and unambiguous consent of the Data Principal; or (b) certain legitimate uses as permitted under Section 7 of the DPDP Act (e.g., compliance with legal obligations, performance of a contract with the Data Principal, or response to a medical emergency).

6.2 Data Principal Rights

Under the DPDP Act, Data Principals (users) have the following rights:

• Right to Access: Right to obtain a summary of personal data being processed and the processing activities undertaken.
• Right to Correction & Completion: Right to have inaccurate or incomplete personal data corrected, completed, or updated.
• Right to Erasure: Right to request erasure of personal data where consent has been withdrawn, the specified purpose has been fulfilled, or the data is no longer necessary. Upon receipt of a valid erasure request, we shall erase the data and direct all data processors to do the same, subject to applicable legal retention obligations.
• Right to Grievance Redressal: Right to have grievances addressed by our designated Data Protection Officer / Grievance Officer.
• Right to Nominate: Right to nominate another individual to exercise data rights in the event of the Data Principal's death or incapacity.

6.3 Consent Management

We obtain and record explicit consent for each purpose of data processing at the point of collection. Users may withdraw consent at any time through their account settings or by contacting our Data Protection Officer. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal. Records of consent, including grants, modifications, and withdrawals, are maintained for a minimum period of one (1) year as mandated by Rule 6 of the DPDP Rules 2025.

6.4 Data Processing for Children

We do not knowingly process the personal data of children (individuals below the age of 18 years) without verifiable parental or guardian consent. If we become aware that we have inadvertently collected data from a child without appropriate consent, we will take immediate steps to delete such data.

7. Global Data Protection — GDPR (EU) & CCPA (USA)

7.1 GDPR Compliance (European Economic Area Users)

For users located within the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). In addition to rights provided under Indian law, EEA users enjoy:

• Right to be Forgotten (Article 17): Right to erasure of personal data without undue delay where the data is no longer necessary, consent is withdrawn, or the data has been unlawfully processed.
• Right to Data Portability (Article 20): Right to receive personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): Right to object to processing based on legitimate interests, direct marketing, or profiling.
• Cross-Border Data Transfers: Any transfer of personal data outside the EEA is conducted pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms under Chapter V of the GDPR.

7.2 CCPA Compliance (California Residents)

For users who are residents of the State of California, United States, we comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). California residents have the right to:

• Know what personal information is collected, used, shared, or sold.
• Delete personal information held by the business and its service providers.
• Opt out of the sale or sharing of personal information.
• Non-discrimination for exercising any CCPA rights.

We do not sell personal information as defined under the CCPA. To exercise your rights, contact our Data Protection Officer using the details provided in the Grievance Redressal section below.

8. Financial Data Storage & RBI Compliance

8.1 Sensitive Personal Data & Financial Information

We classify the following as "Sensitive Personal Data or Information" (SPDI) under applicable Indian law and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: passwords, financial information (bank account details, credit/debit card details, UPI identifiers), biometric data, and health data.

In compliance with the Reserve Bank of India's (RBI) data localisation mandates and the RBI Digital Lending Directions, 2025:

• All payment-related data, card-on-file data, and financial transaction data of Indian users is stored exclusively on servers located within India.
• Where any financial data is processed outside India for operational purposes, such data is deleted from foreign servers within 24 hours of processing, and only the processed output is retained domestically.
• We comply with RBI's tokenisation mandates — no actual card data (card number, CVV, expiry date) is stored on our servers. All card data is tokenised through RBI-approved tokenisation service providers.
• We do not store biometric data unless explicitly consented to and permitted under applicable law.

8.2 Payment Processing

All payments on this platform are processed through RBI-licensed payment aggregators and payment gateways. We do not directly collect, store, or process payment card industry (PCI) data. Our payment processing partners are PCI-DSS Level 1 certified and comply with all applicable RBI regulations.

9. Information Technology Act, 2000 & Intermediary Rules

9.1 Intermediary Status & Safe Harbour

To the extent that the Company acts as an "intermediary" as defined under Section 2(1)(w) of the Information Technology Act, 2000 ("IT Act"), we claim the benefit of the safe harbour protections available under Section 79 of the IT Act, read with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended in 2023 and 2026).

We do not initiate the transmission, select the receiver of, or modify the information contained in user-generated content. We are not liable for any third-party information, data, or communication hosted on or transmitted through our platform, provided we exercise due diligence and comply with the take-down obligations prescribed under the IT Act and Rules.

9.2 User-Generated Content

Any content uploaded, posted, or transmitted by users (including professional profiles, reviews, comments, and documents) is the sole responsibility of the user who authored or uploaded such content. We do not endorse, verify, or guarantee the accuracy, legality, or reliability of any user-generated content. Users are prohibited from uploading content that is defamatory, obscene, threatening, invasive of privacy, infringing of intellectual property, or in violation of any applicable law.

9.3 Compliance with IT Amendment Rules, 2026

In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified by the Ministry of Electronics and Information Technology (MeitY), effective 20 February 2026, we have implemented the following measures:

• Enhanced quarterly user notification of platform terms and consequences of non-compliance, including account suspension and content removal.
• Mechanisms for users to declare and label Synthetically Generated Information (SGI) prior to upload or publication.
• Technical measures to detect, label, and where required, block unlawful SGI content in accordance with the prescribed categories.
• Compliance with shortened takedown timelines (including the revised 3-hour window for certain categories of unlawful content as prescribed under the 2026 Amendment Rules).

10. Artificial Intelligence & Synthetically Generated Information (SGI) Disclosure

• AI-Powered Features: The following features on this platform utilise AI models to generate, summarise, analyse, or augment content: (a) IPO Readiness Assessment scoring and recommendations; (b) Business Valuation report generation (DCF, NAV, Comparable analyses); (c) DRHP section drafting assistance and compliance gap analysis; (d) Financial data extraction from uploaded documents (Excel, PDF); (e) Match-Making Platform AI recommendations; and (f) Blog articles and research summaries that may incorporate AI-generated or AI-assisted analysis.
• Nature of AI Output: All AI-generated content is indicative, probabilistic, and subject to error. AI models may produce inaccurate, incomplete, outdated, or misleading output (commonly referred to as "hallucinations"). AI-generated content should never be treated as a substitute for professional human expertise, legal advice, financial advice, or audited financial statements.
• Labelling: Where technically feasible, AI-generated or AI-assisted content on this platform is labelled with appropriate disclosures (e.g., "AI-Generated", "AI-Assisted", or equivalent notation). We embed metadata identifiers where technically practicable to enable traceability of synthetically generated content in compliance with the 2026 IT Amendment Rules.
• Third-Party AI Models: We utilise third-party AI models and APIs (including but not limited to models provided by OpenAI, Google, and Anthropic) for content generation. The outputs of these models are subject to the terms, limitations, and disclaimers of the respective AI service providers. We do not control and cannot guarantee the accuracy, safety, or appropriateness of third-party AI model outputs.
• No Autonomous Decision-Making: AI models on this platform do not make autonomous financial, legal, or business decisions on behalf of users. All AI-generated outputs are intended as decision-support tools that require independent human review, judgement, and professional validation before any action is taken.

11. Intellectual Property Rights

11.1 Company Intellectual Property

The trademarks, service marks, logos, trade names, and brand elements "IPOLabs", "The Match-Making Platform", and all associated visual elements are the intellectual property of IPOLabs AI Private Limited. All rights are reserved.

The website's source code, design, layout, software, algorithms, databases, text, graphics, images, and all other proprietary content are protected by Indian copyright law (Copyright Act, 1957), international copyright treaties, and other applicable intellectual property laws.

11.2 Third-Party Trademarks

All third-party trademarks, service marks, trade names, logos, and brand identifiers mentioned on this website — including but not limited to "NSE", "National Stock Exchange", "NIFTY", "NIFTY 50", "BSE", "Bombay Stock Exchange", "SENSEX", "S&P BSE SENSEX", "Protean", "NSDL", "CDSL", "SEBI", "RBI", "MCA", "GSTN" — are the registered trademarks and intellectual property of their respective owners. Their use on this website is for identification and informational purposes only and does not imply any affiliation, endorsement, or sponsorship.

11.3 Restrictions

Users may not reproduce, distribute, modify, create derivative works from, publicly display, transmit, sell, license, or exploit any content from this website without the prior written permission of IPOLabs AI Private Limited, except for personal, non-commercial use in accordance with applicable fair use / fair dealing provisions under Indian copyright law.

12. Limitation of Liability & Indemnification

To the fullest extent permitted by applicable law:

• IPOLabs AI Private Limited, its directors, officers, employees, agents, consultants, partners, and affiliates shall NOT be liable for any direct, indirect, incidental, special, consequential, punitive, or exemplary damages arising out of or in connection with the use or inability to use this website, its services, content, or tools.
• This limitation applies to, but is not limited to: (a) investment losses; (b) loss of profits, revenue, data, or business opportunity; (c) reliance on information, analyses, or AI-generated content provided on this platform; (d) errors, inaccuracies, or omissions in any data or content; (e) service interruptions, security breaches, or technical failures; and (f) any actions taken by users based on DRHP analyses, valuation reports, readiness assessments, or any other content provided herein.
• Users agree to indemnify and hold harmless IPOLabs AI Private Limited and its personnel from any claims, damages, losses, liabilities, and expenses (including legal fees) arising from the user's breach of these terms, violation of applicable law, or infringement of any third-party rights.

13. Data Retention & Deletion Policy

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods include:

• Account Data: Retained for the duration of the active account and for a period of three (3) years following account deletion or inactivity, in accordance with the Third Schedule of the DPDP Rules 2025 (applicable to specified Data Fiduciaries). A 48-hour advance notice is provided before erasure pursuant to the inactivity provision.
• Transaction Data: Retained for a minimum of eight (8) years in compliance with Indian tax laws (Income Tax Act, 1961), GST regulations, and RBI requirements.
• Communication Logs: Retained for a period of one hundred and eighty (180) days from the date of the communication, in compliance with the Information Technology (Intermediary Guidelines) Rules requirement for intermediaries to retain information for law enforcement purposes, even after account deletion or content removal.
• Consent Records: Records of consent grants, modifications, and withdrawals are retained for a minimum of one (1) year as mandated by Rule 6 of the DPDP Rules 2025.
• Audit Logs: System and access logs are retained for a minimum of one hundred and eighty (180) days in compliance with IT Act requirements.

14. Grievance Redressal & Contact Information

14.1 Grievance Officer / Data Protection Officer

In compliance with Rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended), and the DPDP Act 2023, the following officer has been designated as the Grievance Officer and Data Protection Officer:

14.2 Grievance Resolution Timeline

• Acknowledgement: All grievances shall be acknowledged within 24 hours of receipt.
• Resolution: The Grievance Officer shall endeavour to resolve grievances within fifteen (15) days from the date of receipt, as mandated under the IT Rules.
• Escalation: If unsatisfied with the resolution, users may escalate their complaint to the appropriate regulatory authority, including the Data Protection Board of India (for DPDP Act matters), the Appellate Tribunal under the IT Act, or the relevant consumer forum.

14.3 Law Enforcement Requests

We cooperate with law enforcement agencies and regulatory authorities in accordance with applicable Indian law. Requests for user data or content removal by law enforcement agencies are processed in compliance with the IT Act, the Code of Criminal Procedure, 1973 (now Bharatiya Nagarik Suraksha Sanhita, 2023), and applicable court orders.