Privacy is how trust is built.

To run Lumaara, we collect three categories of data:

• Operational data you put in — customer inquiries, measurements, quotes, orders, invoices, payments, work-order scans, photos, signatures. This is YOUR data; we store and process it on your behalf.
• Account data — name, email, phone, and role of each Lumaara user in your tenant. Used for login, access control, audit logging, and support.
• Technical telemetry — minimal, privacy-respecting analytics and error reporting (scrubbed of personal data where feasible) used to keep the product working and improve it.

We do not seek to collect biometric data, precise location data, government identifiers, or other sensitive personal data beyond what your business chooses to record or what is required for tax/GST compliance.

Your data is used strictly to:

• Run the Lumaara product for you — store records, generate documents, and operate the features you use.
• Provide support — when you contact us, we may view relevant records to help.
• Maintain and improve the product using aggregated, de-identified metrics — never by reading individual records for unrelated purposes.
• Send service notifications (billing, security, downtime). Marketing communications are opt-in only.

Some features of Lumaara — such as the in-app AI assistant — are optional and turned off by default. When enabled, they work by sending the specific records you choose to use them on to a third-party AI service that generates the result.

We do this only if you opt in and consent. The scope of what is shared, and your consent, are recorded in your service agreement. If you do not enable AI features, none of your data is sent to any AI service, and you can turn these features off at any time.

We do not use your data to train AI models, and we do not sell or share your data for advertising.

We share specific data only with the specific service providers (sub-processors) required to deliver the service you use — for example:

• Cloud hosting & storage — to run the product and store your data securely.
• Messaging providers (WhatsApp / SMS / email) — when you send a customer a document or message.
• Payment processors — for subscription billing (we never see your full card details).
• Analytics & error monitoring — privacy-respecting, to keep the product reliable.
• AI service providers — only if you opt in to AI features (see above).

We do not sell your data or share it for advertising. Our sub-processors may change over time as the product evolves; a current list is available on request, and we use reputable providers under appropriate safeguards.

Your primary database and file storage are hosted on secure cloud infrastructure, with India-based storage where feasible. Backups are encrypted.

Certain optional features rely on sub-processors that may process limited data outside India — for example, AI features (if you opt in) and message delivery via global messaging platforms. We use reputable providers and appropriate safeguards for any such processing.

India's Digital Personal Data Protection Act, 2023 grants you the following rights, which we honour:

• Right to access — request a copy of the data we hold about you.
• Right to correction — fix inaccurate or incomplete data.
• Right to erasure — delete your data, subject to legal retention requirements (e.g., tax records).
• Right to grievance redressal — raise a concern; we respond within the timelines required by law.
• Right to nominate — appoint another person to exercise these rights in case of incapacity.

Email privacy@datacaffe.in to exercise any of these.

The Lumaara marketing website uses no advertising cookies and no third-party ad trackers. We use only minimal, privacy-respecting analytics.

The Lumaara product uses a first-party cookie for your login session. That's it.

Lumaara is a B2B product for businesses. We do not knowingly collect data from individuals under 18. If you believe a child's data has reached our systems by mistake, email privacy@datacaffe.in and we will delete it.

When this policy changes materially, we notify the tenant admin by email in advance. The "Last updated" timestamp at the top of this page always reflects the current version, and a record of past versions is available on request.

Drighna Technology Pvt Ltd (operating as “DataCaffe”) has designated a contact for data-protection queries and grievances under the DPDP Act.

Grievance / Data Protection Contact
dpo@datacaffe.in
Drighna Technology Pvt Ltd (operating as “DataCaffe”), India

For grievances under the DPDP Act, you may also approach the Data Protection Board of India after first giving us a reasonable opportunity to respond.