Privacy Policy

Welcome to Xunuras. This Privacy Policy ("Policy") describes how Xunuras ("Xunuras", the "Company", "we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you use the Xunuras mobile application, the Xunuras website (xunuras.com), Xunuras Talk communication features, and all related services (collectively, the "Services").

By creating an account, accessing, or using the Services, you expressly acknowledge that you have read, understood, and agreed to be bound by this Policy and consent to the collection, use, processing, storage, and transfer of your personal information as described herein. If you do not agree with this Policy, you must not access or use the Services. Your continued use of the Services after any update to this Policy constitutes your acceptance of the updated Policy.

This Policy forms an integral part of, and must be read together with, the Xunuras Terms of Service. In the event of any conflict between this Policy and the Terms of Service regarding data handling, this Policy shall prevail.

Xunuras is a social networking and rewards platform operated from the People's Republic of Bangladesh. Xunuras is the data controller responsible for personal information processed through the Services.

For all privacy-related inquiries, contact privacy@xunuras.com. For general support, contact support@xunuras.com.

Information you provide directly:

• Account information: name, username, email address, phone number, date of birth, gender, and password (stored in hashed form).
• Profile information: profile and cover photos, biography, education history, workplaces, current city, hometown, relationship status, websites, and other details you choose to add to your profile.
• Content you create: posts, stories, reels, videos, photos, audio, comments, reactions, group content, marketplace listings, and messages sent through Xunuras Talk.
• Financial and transaction information: wallet balances, earning and commission history, membership tier and payment records, withdrawal requests and associated payout details, currency display preferences (USDT/BDT), and transaction identifiers processed by our payment partners. We do not store full card numbers or payment credentials; these are handled by licensed payment processors.
• Referral and network information: your referral code, the users you invite, and the structure of your referral network needed to calculate bonuses, ranks, and multi-generation earnings.
• Nominee information: if you use the nominee/inheritance feature, the name and contact details of your designated nominee. You confirm you have the nominee's authority to provide their information to us.
• Identity verification: where required by law or for withdrawal processing, identity documents and related verification data.
• Communications with us: support requests, feedback, reports, and correspondence.

Information collected automatically:

• Device information: device model, operating system and version, unique device identifiers, app version, language, and time zone.
• Usage information: log data, IP address, pages and screens viewed, features used, content interactions, session duration, and referral URLs.
• Diagnostics and crash data: crash logs and performance data collected through Firebase Crashlytics to keep the Services stable.
• Push notification tokens: device tokens issued by Firebase Cloud Messaging so we can deliver notifications you have enabled.
• Cookies and similar technologies (website): session cookies, authentication tokens, and analytics cookies. You can control cookies through your browser settings; disabling them may limit functionality.

Information collected with your permission — we request device permissions only when needed for a feature, and each is optional:

• Camera and microphone: to capture photos, videos, stories, and reels you choose to create.
• Photos and media library: to let you select media to upload.
• Location: only to attach a location to your posts when you choose to do so. We do not track your location in the background.
• Notifications: to deliver push alerts you have enabled.

You may withdraw any permission at any time through your device settings; the related features may stop working, but the rest of the Services remain available.

Information from third parties:

• Google Sign-In: if you register or log in with Google, we receive your name, email address, and profile picture from Google in accordance with your Google account settings.
• Payment processors: confirmation of payment status and transaction references from our payment partners.
• Other users: content in which you appear or are mentioned, and referral relationships created when another user invites you.

We use personal information to:

1. create and manage your account and authenticate you (including two-factor authentication);
2. provide, operate, personalize, and improve the Services, including your feed, recommendations, and search;
3. operate the membership, referral, ranking, and rewards programs, and calculate and pay commissions and bonuses;
4. process payments, wallet transactions, and withdrawal requests, and maintain accurate financial records;
5. deliver notifications and communications you have enabled (push, email, SMS), which you can manage in Settings;
6. maintain safety and integrity: detect, prevent, and act on fraud, abuse, spam, fake accounts, referral manipulation, security incidents, and violations of our Terms of Service;
7. comply with applicable laws, regulations, lawful requests, and legal process, including record-keeping, tax, and anti-money-laundering obligations;
8. establish, exercise, or defend legal claims and enforce our agreements; and
9. analyze usage in aggregated or de-identified form to develop new features.

Automated processing: feed ranking, content recommendations, fraud detection, and referral-integrity checks involve automated processing. Decisions that produce significant effects (such as account suspension or withdrawal rejection for suspected fraud) are subject to human review upon your request.

Where the law of your jurisdiction requires a legal basis for processing (for example, the EU/UK GDPR), we rely on:

• Contract: processing necessary to provide the Services you signed up for;
• Consent: for optional permissions (camera, microphone, location, photos), marketing communications, and where otherwise required — you may withdraw consent at any time without affecting prior processing;
• Legitimate interests: securing the Services, preventing fraud, improving features, and defending legal claims, balanced against your rights; and
• Legal obligation: compliance with applicable laws, including financial record-keeping and lawful disclosure requirements.

We do not sell your personal information. We share it only as follows:

• With other users, at your direction: content you post publicly or to selected audiences, your profile, and your activity as governed by your privacy settings. Information you make public can be viewed, saved, or re-shared by others — including outside the Services — and we are not responsible for how third parties use information you chose to make public.
• Service providers: hosting and infrastructure providers, Google/Firebase (authentication, push notifications, crash reporting), content delivery networks, analytics providers, email/SMS providers, and payment processors — each bound to process data only on our instructions.
• Payment and withdrawal partners: to the extent necessary to process membership payments and payouts.
• Legal and safety disclosures: to courts, law enforcement, regulators, or other government authorities of Bangladesh or other jurisdictions where we in good faith believe disclosure is required by law, lawful order, or legal process, or is necessary to protect the rights, property, or safety of Xunuras, our users, or the public, or to detect and prevent fraud or crime.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as a business asset, subject to this Policy or a successor policy.
• With your consent: any other sharing you explicitly authorize.
• Aggregated or de-identified data: which cannot reasonably identify you, for any lawful purpose.

Xunuras operates under the laws of the People's Republic of Bangladesh, including the Information and Communication Technology Act, 2006; the Cyber Security Act, 2023 (as amended or replaced from time to time); the Bangladesh Telecommunication Regulation Act, 2001; and any personal data protection legislation enacted in Bangladesh, upon its coming into force.

Accordingly, you acknowledge and agree that:

1. we may retain and disclose user records to competent Bangladeshi authorities pursuant to lawful requests, orders, or directives, without separate notice to you where notice is prohibited or impracticable;
2. we may preserve and disclose information reasonably necessary to investigate or report offenses under applicable cyber security and ICT laws, including content that is unlawful, defamatory, or threatening to public order under Bangladeshi law;
3. financial features (wallet, earnings, withdrawals) are operated subject to Bangladesh Bank regulations, foreign exchange rules, and applicable anti-money-laundering laws, and we may collect additional verification information and report suspicious transactions where required; and
4. removal or restriction of content or accounts to comply with Bangladeshi law shall not give rise to any liability of the Company.

Your information may be stored and processed in Bangladesh and in other countries where we or our service providers (including cloud and Firebase infrastructure) operate. These countries may have data protection laws different from those of your jurisdiction. By using the Services, you consent to such transfers. Where required (for example, for users in the EEA/UK), we implement appropriate safeguards such as standard contractual clauses. As we expand globally, we will adopt additional region-specific safeguards required by local law.

We retain personal information for as long as your account is active and as needed to provide the Services. Thereafter, we retain information only:

• as required by applicable law (including financial, tax, and transaction records, which we may retain for the period prescribed by Bangladeshi law);
• to resolve disputes, enforce our agreements, and establish or defend legal claims;
• to prevent fraud and abuse (including records of banned accounts and referral-integrity investigations); and
• in backups for a limited period until routine deletion cycles complete.

If you deactivate your account, we preserve your data so you can reactivate later. If you delete your account, we delete or de-identify your personal information within a reasonable period, subject to the retention grounds above. Content you shared with others (such as messages delivered to other users or content re-shared by them) may remain visible to those users after your deletion.

We implement industry-standard technical and organizational safeguards, including encryption in transit (TLS), encrypted local credential storage, hashed passwords, access controls, certificate pinning, optional two-factor authentication, and monitoring.

However, no method of transmission or storage is completely secure. We cannot and do not guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials, enabling available security features, and notifying us immediately at support@xunuras.com of any suspected unauthorized access. To the maximum extent permitted by applicable law, the Company shall not be liable for damages arising from unauthorized access, hacking, or data breaches beyond our reasonable control, provided we have implemented the safeguards required by applicable law. Where a breach notification is required by law, we will notify affected users and/or the relevant authorities within the legally mandated period.

Subject to applicable law and verification of your identity, you may:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information (via profile and settings, or by contacting us);
• Delete your account and personal information, subject to Section 9;
• Deactivate your account temporarily via Settings;
• Export a copy of your data in a portable format;
• Withdraw consent for optional permissions and processing at any time;
• Manage notifications (push, email, SMS) in Settings;
• Control audiences for your content through privacy settings; and
• Object to or restrict certain processing where local law grants that right.

To exercise a right, use the in-app controls or email privacy@xunuras.com. We respond within the period required by applicable law (and in any case endeavor to respond within 30 days). We may refuse requests that are manifestly unfounded, excessive, or that would adversely affect the rights of others, and we may retain information as permitted by Section 9. Exercising your rights does not entitle you to deletion of records we are legally required to keep (including transaction and payout records).

EEA/UK users (GDPR): you additionally have the rights to data portability, to object to processing based on legitimate interests, to restrict processing, not to be subject to solely automated decisions with legal effects, and to lodge a complaint with your local supervisory authority.

California residents (CCPA/CPRA): you have the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information, and the right to non-discrimination for exercising these rights. Xunuras does not sell personal information as defined by the CCPA.

Other jurisdictions: as Xunuras expands globally, users in other jurisdictions will be afforded the rights granted by their local data protection laws. Where this Policy conflicts with mandatory local law, local law prevails to the extent of the conflict for users in that jurisdiction.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or a higher minimum age where local law requires). Users under 18 must have the consent of a parent or legal guardian to use the Services, and financial features (membership purchase, wallet, withdrawals) are available only to users who are at least 18 or the age of majority in their jurisdiction. If we learn that we have collected personal information from a child in violation of this section, we will delete it and may terminate the account. Parents or guardians may contact privacy@xunuras.com.

The Services may contain links to third-party websites, products, or services (including payment processor pages and content shared by users), and integrate third-party services such as Google Sign-In and Firebase. Those third parties operate under their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policy of every third-party service you interact with. Your use of third-party services is at your own risk.

You agree that you will: provide accurate information and keep it updated; not upload another person's personal information or images without lawful authority or consent; not collect, scrape, or harvest other users' data from the Services; respect the privacy of others in content you post and messages you send; and comply with applicable laws when using the Services. You are solely responsible for the information you choose to share publicly, and for any consequences of that sharing. Violation of these responsibilities may result in suspension or termination of your account and may expose you to legal liability, and you agree to indemnify the Company as set out in the Terms of Service for claims arising from your violation.

To the maximum extent permitted by applicable law:

1. the Services and all related data processing are provided on an "as is" and "as available" basis, without warranties of any kind, express or implied;
2. the Company shall not be liable for any indirect, incidental, special, consequential, punitive, or exemplary damages, or loss of profits, data, goodwill, or business opportunity, arising out of or relating to this Policy or the processing of your information;
3. the Company's total aggregate liability for any claim arising out of or relating to this Policy shall not exceed the greater of (a) the total membership fees you paid to Xunuras in the twelve (12) months preceding the claim, or (b) BDT 5,000 (five thousand taka);
4. the Company is not responsible for the acts or omissions of other users, including their use or redistribution of information you made available to them; and
5. nothing in this Policy excludes or limits liability that cannot be excluded or limited under applicable law, and where such law grants you non-waivable rights, those rights prevail.

We may amend this Policy at any time at our sole discretion, including to reflect changes in the Services, technology, law, or our business. When we make material changes, we will notify you through the Services (such as an in-app notice, email, or a prominent notice on the website) and update the "Last Updated" date. Changes take effect on the date stated in the revised Policy. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy. If you do not agree to a revised Policy, your sole remedy is to stop using the Services and delete your account. We encourage you to review this Policy periodically; the current version is always available at xunuras.com/privacy and within the app.

1. Governing law: this Policy and any dispute or claim arising out of or in connection with it (including non-contractual disputes) shall be governed by and construed in accordance with the laws of the People's Republic of Bangladesh, without regard to conflict-of-law principles.
2. Amicable resolution first: before initiating any formal proceeding, you agree to first contact us at legal@xunuras.com and attempt in good faith to resolve the dispute informally for at least sixty (60) days.
3. Arbitration: any dispute not resolved amicably shall be finally settled by binding arbitration in Dhaka, Bangladesh, under the Arbitration Act, 2001 (Bangladesh), by a sole arbitrator appointed in accordance with that Act. The language of arbitration shall be English or Bengali. The arbitral award shall be final and binding on the parties.
4. Exceptions: either party may seek injunctive or equitable relief from the courts of Dhaka, Bangladesh, for matters of intellectual property, unauthorized access, or data misuse. Where the mandatory consumer protection law of your country of residence grants you the right to bring proceedings in your local courts, nothing in this section deprives you of that right.
5. Individual capacity: to the maximum extent permitted by law, disputes shall be resolved on an individual basis; class or representative actions are waived.
6. Time limit: any claim arising out of or relating to this Policy must be initiated within one (1) year after the cause of action accrues, or the shortest longer period required by applicable mandatory law, failing which such claim is permanently barred.

If any provision of this Policy is held invalid or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall remain in full force and effect. This Policy, together with the Terms of Service and any supplemental notices, constitutes the entire agreement between you and the Company regarding the processing of your personal information and supersedes all prior understandings on that subject.

• Privacy inquiries and rights requests: privacy@xunuras.com
• General support: support@xunuras.com
• Legal notices and disputes: legal@xunuras.com

We aim to acknowledge privacy inquiries within 7 days and resolve them within 30 days.