Privacy Policy

1.Who we are

This policy explains how [COMPANY LEGAL NAME] (“Lasso”, “we”) collects and uses personal data when you use the Lasso app and website. For this data Lasso is the data fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). We also follow the Information Technology Act, 2000 and the rules made under it.

Lasso is only for people aged 18 and over.

2.What we collect

We collect what you give us, what is created when you use Lasso, and a little information from your device.

Calls and live sessions are not recorded. Audio and video travel in real time between participants through our audio/video providers. If we ever offer recording, it will be switched on by the host, everyone in the session will be told before it starts, and this policy will be updated first. In the Lasso app, screenshots and screen recording are blocked on calls, live sessions, messages, profiles, galleries and circle feeds to protect everyone’s privacy. Receipts, transaction history and booking details can still be captured.

Workshop videos uploaded by a host are stored only for the session they belong to and are streamed only to ticket holders.

3.Circle messages and legal holds

Messages and posts in circle feeds are end-to-end encrypted: they are encrypted on the sender’s device and can be read only on the devices of circle members. Lasso’s servers store them in encrypted form and cannot read them. They disappear after the period shown in the app.

If a court or an authorised agency lawfully requires it, Lasso can place a specific circle room under a legal hold. Members of that room see a notice. Their devices then seal copies of the messages they still hold with a key that only the designated legal custodian can open, and upload them so they are preserved. Lasso itself still cannot read them.

4.How we use your data

• To provide Lasso: accounts, profiles, discovery, calls, bookings, circles, sessions, gifts, subscriptions and notifications.
• To handle money: credit coins, bill calls and bookings, issue GST invoices, reverse wrongful charges, pay creators, deduct TDS and file tax returns.
• To keep people safe: verify age, review reports, moderate content, prevent fraud and misuse, and respond to lawful requests.
• To support you: answer support tickets and complaints.
• To improve Lasso: understand how features are used and fix problems, using aggregated or de-identified data where possible.
• To tell you about Lasso: offers and updates, only if you have agreed. You can switch these off at any time.

We don’t sell your personal data, and we don’t use it for third-party advertising.

5.Why we are allowed to use it

We use your personal data:

• with the consent you give when you sign up and when you agree to specific features (for example location). You can withdraw consent at any time; we will then stop the related processing, though we may no longer be able to provide some or all of the service; and
• for the legitimate uses the DPDP Act allows without fresh consent, such as complying with the law, responding to court orders and government requests, dealing with emergencies, and using data you gave us voluntarily for the purpose you gave it.

6.Who sees your data

• Other people on Lasso see your public profile: display name, photo or avatar, bio, interests, voice intro, gallery, status, online presence and, for creators, rates and ratings. Your mobile number is never shown to other users.
• Creators see the display name and photo of people who call, book or subscribe to them, and the details of those bookings.
• Service providers who process data for us under contract and only on our instructions:

• Authorities: tax authorities (for example TDS returns that include a creator’s PAN, and GST returns), and courts or government agencies when the law requires it.
• Professional advisers (auditors, lawyers) under a duty of confidentiality, and a buyer of Lasso’s business if it is ever sold, who must keep this policy’s promises.

7.Data outside India

Some service providers may process data outside India. We only transfer personal data to countries the Government of India has not restricted under the DPDP Act, and we require providers to protect it to the standard in this policy.

8.How long we keep it

When we no longer need data, we delete it or anonymise it so it can no longer identify you.

9.How we protect it

• Data is encrypted in transit (TLS) between the app, the website and our servers.
• PAN, GSTIN, bank account numbers and UPI IDs are encrypted at rest and shown only masked (for example the last four characters). Only a small finance team can view them in full, and every view is logged.
• Access to personal data is limited by role, and admin actions are recorded in an audit log.
• If a personal data breach happens, we will inform the Data Protection Board of India and affected users as the DPDP Act requires.

10.Your rights and choices

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and how we use it;
• correct, complete or update it (most of it you can change yourself in Edit profile);
• ask us to erase it (through Settings → Delete profile request), except data we must keep by law;
• withdraw consent you have given;
• nominate someone to exercise these rights if you die or become unable to; and
• complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

To use these rights, write to our Grievance Officer at [GRIEVANCE OFFICER EMAIL] or use Help & support in the app. We may need to confirm your identity first. We acknowledge requests within 24 hours and respond within the time the law allows.

11.App permissions

The app asks for permissions only when a feature needs them, and you can change them in your phone’s settings:

• Microphone and camera for calls, voice intros, video statuses and sessions;
• Location for nearby discovery;
• Notifications for incoming calls, bookings and messages;
• Photos and files to upload gallery items;
• Calendar to add your bookings, if you choose; and
• for creators, an exemption from battery optimisation so the app can keep you online while your phone is locked.

12.Our website

The Lasso website does not use advertising or tracking cookies. The creator sign-up page keeps your sign-in session in your browser’s local storage so you can continue where you left off; signing out or clearing site data removes it.

13.Children

Lasso is not for anyone under 18, and we don’t knowingly process children’s personal data. If we learn that an account belongs to someone under 18, we close it and delete their data, except records the law requires us to keep.

14.Changes to this policy

Each version of this policy has a version number and an effective date (shown at the top). If we make an important change, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.

15.Contact

Grievance Officer (also handling data-protection requests): [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL], [GRIEVANCE OFFICER ADDRESS]. See the Grievance Redressal page for timelines.