CONSENT FRAMEWORK

Hunch — operated by CMA Solutions LLP

Document Reference: HUN-LEG-CF-V3.0 Version: 3.0 (Draft for attorney review) Effective Date: [TO BE INSERTED] Last Updated: [TO BE INSERTED]

NOTICE — DRAFT INSTRUMENT. For counsel review before publication. Not legal advice.

1. PURPOSE

1.1 This Consent Framework ("Framework") sets out the manner in which CMA Solutions LLP ("Company") obtains, records, manages, and gives effect to the withdrawal of, consent from Users in connection with the conversational AI service marketed as "Hunch" (the "Service").

1.2 This Framework is published in compliance with: (a) Section 6 (consent) and Section 9 (children's data) of the Digital Personal Data Protection Act, 2023 ("DPDP Act"); (b) the Digital Personal Data Protection Rules made thereunder ("DPDP Rules"); (c) Rule 5 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") (consent prior to collection of SPDI); (d) policies of the WhatsApp Business Platform applicable to messaging-based commerce.

1.3 This Framework is a Constituent Document under the Terms of Service (HUN-LEG-TOS-V3.0) and must be read together with the Privacy Policy (HUN-LEG-PP-V3.0).

2. DEFINITIONS

Capitalised terms used in this Framework and not defined herein bear the meanings given in the Terms of Service and the Privacy Policy.

3. CONSENT ARCHITECTURE — FOUR LAYERS

3.1 The Service uses a four-layer consent architecture. Each layer is independent and is sought through a separate plain-language notice. Refusal of a non-mandatory layer shall not affect the User's access to the Service save as expressly stated.

3.2 Specific and informed consent. Each consent layer satisfies the requirements of Section 6 of the DPDP Act by: (a) describing the specific purpose for which Personal Data will be processed; (b) describing the categories of Personal Data to be processed; (c) identifying third parties to whom data will be disclosed; (d) describing the User's rights in relation to such consent; (e) being capable of being withdrawn at any time.

3.3 Order of layers. Consent under Layer 1 is a precondition to Layer 2, Layer 3, or Layer 4. The User cannot grant Layer 2, Layer 3, or Layer 4 consent without first having granted Layer 1.

3.4 Prospective effect of secondary layers. Layer 2 consent operates only prospectively: data processed before the date of Layer 2 consent shall not be used for AI training. Layer 3 consent operates only prospectively in respect of research use. Segregation of pre-consent data from training pipelines is enforced by the Company through engineering controls.

4. LAYER 1 — CORE SERVICE CONSENT

4.1 Trigger. Layer 1 consent is sought before any collection of Personal Data, Astrological Data, Conversation Data, or Behavioural Data.

4.2 Form of notice. The Layer 1 consent notice shall be presented to the User on the User's first interaction with the Service, in English or, at the User's election, in Hindi or such other supported Indian language. An indicative form of the notice is set out in Schedule 1 to this Framework.

4.3 Content of notice. The notice shall, in plain language: (a) identify the Company as the Data Fiduciary; (b) describe the Service in summary form; (c) describe the categories of data to be collected (Personal Data, Astrological Data, Conversation Data, Behavioural Data); (d) describe the routing of Conversation Data via Open Router to Underlying LLM Providers, including those located outside India; (e) describe the data-storage location (India); (f) confirm that the Service is not a medical service, Mental Health Establishment, therapy, or crisis service, with emergency-services information; (g) confirm the 18+ age requirement; (h) point the User to the full legal documentation at use-hunch.com/legal.

4.4 Method of acceptance. Layer 1 consent is given by the User's affirmative reply (e.g., "I AGREE", or its equivalent in the language of the notice). Continuation of conversation, silence, or implied conduct shall not constitute consent.

4.5 Recording. Each Layer 1 consent event shall be recorded with: (a) timestamp (UTC and Indian Standard Time); (b) phone-number identifier of the User; (c) messaging platform (WhatsApp / Telegram / other); (d) version identifier of the consent notice presented; (e) language of the consent notice; (f) User's affirmative response.

5. LAYER 2 — AI TRAINING CONSENT

5.1 Trigger. Layer 2 consent is sought after the User's third (3rd) conversation with the Service, or earlier upon the User's express request.

5.2 Form of notice. Plain language; indicative form in Schedule 2.

5.3 Content of notice. The notice shall: (a) state that User Content, after pseudonymisation, may be used to train and improve the Company's AI systems; (b) describe what pseudonymisation entails and acknowledge that pseudonymisation does not eliminate the theoretical risk of re-identification (cross-reference Clause 11 of the Privacy Policy); (c) confirm that refusal does not affect Service access; (d) confirm the right to withdraw at any time; (e) confirm that pre-Layer-2 data will not be used for training.

5.4 Method of acceptance. Affirmative reply (e.g., "YES", "TRAIN HUNCH").

5.5 Recording. As Clause 4.5, additionally recording the layer.

6. LAYER 3 — RESEARCH CONSENT

6.1 Trigger. Layer 3 consent is sought after the User's fifth (5th) conversation, or upon User request.

6.2 Content of notice. The notice shall describe: (a) that Pseudonymised User Content may be used for research, including with academic or research institutions; (b) the pseudonymisation standards (cross-reference Privacy Policy); (c) that research outputs may be published or licensed but shall not contain identifying information; (d) the right to refuse without affecting Service access; (e) the right to withdraw at any time.

6.3 Method of acceptance. Affirmative reply (e.g., "YES FOR RESEARCH").

7. LAYER 4 — THERAPIST HANDOFF CONSENT

7.1 Layer 4 is governed by the Therapist Handoff Consent and Protocol (HUN-LEG-THP-V3.0). The substantive content, recording requirements, and withdrawal mechanism applicable to Layer 4 are set out in that document and prevail to the extent of any inconsistency with this Framework.

8. WITHDRAWAL OF CONSENT

8.1 Method. The User may withdraw any layer of consent by:

Alternatively, by email to support@use-hunch.com bearing the subject line "Consent Withdrawal".

8.2 Effect.

(a) Layer 1 withdrawal. Service is terminated. The Company shall: (i) cease processing within seventy-two (72) hours of receipt; (ii) delete identifiable Personal Data, Astrological Data, Conversation Data, and Behavioural Data within thirty (30) days, subject to the exceptions set out in the Data Retention and Deletion Policy.

(b) Layer 2 withdrawal. AI training shall not use new User Content from the date of withdrawal. Pseudonymised User Content already incorporated in a trained model cannot be retroactively reversed. Service continues.

(c) Layer 3 withdrawal. Research use shall not use new User Content from the date of withdrawal. Pseudonymised User Content already published in a research dataset cannot be retroactively reversed. Service continues.

(d) Layer 4 withdrawal. Governed by the Therapist Handoff Consent and Protocol. Service continues.

8.3 Recording. Each withdrawal event shall be recorded with: (a) timestamp; (b) layer(s) withdrawn; (c) method of withdrawal (message / email); (d) confirmation acknowledgement sent to the User.

8.4 Confirmation to User. The Company shall send confirmation of receipt of the withdrawal request within twenty-four (24) hours and confirmation of completion of processing-cessation within seventy-two (72) hours.

9. CHILDREN'S DATA AND VERIFIABLE CONSENT

9.1 Strict 18+ policy. The Service does not knowingly collect, process, or retain Personal Data of any individual under the age of eighteen years.

9.2 Self-declaration model. As a matter of Layer 1 consent, the User is required to confirm being eighteen years of age or above. The Layer 1 notice expressly states the 18+ requirement.

9.3 Detect-and-purge protocol. If at any time the Company forms a reasonable belief that the User is under eighteen, whether by reason of statements made by the User in conversation or by reason of other indicators, the Company shall: (a) immediately cease the substantive conversation; (b) inform the User that the Service is restricted to persons aged 18 and above; (c) flag the account for review; (d) within seventy-two (72) hours, permanently delete all identifiable data collected from the User, save Payment Data and Consent Records retained on grounds of legal obligation; (e) block the phone-number identifier from re-registering with the Service, save upon satisfactory subsequent age verification; (f) record the event in an audit log.

9.4 Verifiable parental consent. The Company does not currently process the data of children under any verifiable-parental-consent regime. If the Company in future elects to process children's data, the Company shall implement a verifiable-parental-consent flow conforming to Section 9 of the DPDP Act and the DPDP Rules, and shall publish revised disclosures.

9.5 Future age verification. The Company reserves the right to implement technical age-verification mechanisms (including DigiLocker integration or equivalent) if mandated by the DPDP Rules or considered necessary.

10. CONSENT MANAGERS

10.1 The DPDP Act contemplates the registration of Consent Managers with the Data Protection Board of India.

10.2 Current position. As at the date of this Framework, the Company does not integrate with any registered Consent Manager. Consent is managed directly through the Service and through correspondence with support@use-hunch.com.

10.3 Future integration. When Consent Manager regulations become operational, the Company shall evaluate integration, update this Framework, and inform Users of any change.

11. AUDIT TRAIL

11.1 The Company maintains a complete audit trail of consent events comprising: (a) consent grants (Clause 4.5); (b) consent withdrawals (Clause 8.3); (c) consent text version history (every iteration of each consent notice is archived with a hash); (d) detect-and-purge events under Clause 9.3.

11.2 Consent records are retained for seven (7) years from the date of the consent or withdrawal event, as set out in the Data Retention and Deletion Policy.

11.3 The Company shall make available to a User, on request, a summary of the User's consent record.

12. MATERIAL CHANGES AND FRESH CONSENT

12.1 Where the Company materially modifies a purpose for which a layer of consent has been obtained — including by introducing a new sub-processor in a jurisdiction not previously notified, expanding categories of data collected, or adding a new purpose of processing — fresh affirmative consent shall be sought before processing on the new basis.

12.2 The definition of "material" change is as set out in Clause 16.2 of the Terms of Service.

12.3 Where fresh consent is sought, refusal shall not retroactively invalidate processing under the prior consent, but shall prevent processing under the new basis.

13. ACCESSIBILITY AND ALTERNATIVE FORMATS

13.1 Where a User is unable to give consent through the messaging interface by reason of disability, the Company shall provide alternative means of obtaining and recording consent in compliance with the Rights of Persons with Disabilities Act, 2016. The User may contact support@use-hunch.com to request alternative-format consent.

14. GRIEVANCES AND CONTACT

14.1 Grievances in relation to consent are handled under the Grievance Redressal Policy (HUN-LEG-GRP-V3.0). The Grievance Officer's contact details are set out in that document.

14.2 General contact:

CMA Solutions LLP LLPIN: ACP-6029 Email: support@use-hunch.com Telephone: +91 9667674105.

SCHEDULE 1 — LAYER 1 CONSENT NOTICE (INDICATIVE)

Welcome to Hunch.

Before we begin, please read this carefully.

Who you're talking to. Hunch is a conversational service that uses Vedic astrology (Kundli) as a lens to discuss behavioural patterns. Hunch is operated by CMA Solutions LLP, an Indian limited liability partnership (LLPIN ACP-6029).

What we collect. Your name or preferred name, your phone number, your date, time and place of birth, and your messages. From these, we generate astrological charts and behavioural insights.

How we use AI. Your messages are routed through Open Router LLC (United States) to AI providers that may operate outside India, including in the United States, the European Union, China, and Singapore. The current list is at use-hunch.com/legal/sub-processors.

Where your data is stored. Identifiable data is stored on servers in India.

What Hunch is not. Hunch is not a doctor, therapist, counsellor, astrologer, or crisis service. Hunch is not a Mental Health Establishment under the Mental Healthcare Act, 2017. If you are in crisis, call 112 or Vandrevala Foundation 1860-2662-345.

You must be 18 or older.

Full legal documents: use-hunch.com/legal — including the Terms of Service, Privacy Policy, Disclaimer, and this Consent Framework.

Reply "I AGREE" to begin, or "NO THANKS" to opt out.

(Hindi-language form, with substantively identical content, to be published alongside.)

SCHEDULE 2 — LAYER 2 CONSENT NOTICE (INDICATIVE)

Quick question.

You've used Hunch a few times now. We'd like your permission to use your conversations — after removing your name, phone number, and other identifiers — to improve Hunch's models. We call this "pseudonymisation": it makes the data hard to link back to you, although we cannot say it is impossible.

Important: we will not use your past conversations for training without your permission given here. If you say no, your existing data stays out. If you say yes, only conversations from this point onward become eligible for training.

Saying no does not change your Hunch experience.

Reply "YES" to permit, or "NO" to decline. You can change your mind any time by replying "CHANGE AI CONSENT".

SCHEDULE 3 — LAYER 3 CONSENT NOTICE (INDICATIVE)

One more question — about research.

We'd like to use pseudonymised data (with no way to identify you) for research, including possibly with academic institutions. Research findings may be published.

Saying no does not change your Hunch experience.

Reply "YES FOR RESEARCH" to permit, or "NO" to decline. Change at any time with "CHANGE RESEARCH CONSENT".

SCHEDULE 4 — REVISION HISTORY

END OF CONSENT FRAMEWORK.

Draft for attorney review. Not legal advice.