Privacy Policy

We collect the following types of information:

• Account information: Phone number, name, and email address when you register
• Website content: Pages, images, text, and settings you create using our builder
• Usage data: Pages visited, features used, and general activity on our platform
• Payment information: Billing details processed securely through Razorpay (we never store card numbers)
• Device information: Browser type, operating system, and IP address for security and analytics

We use your information to:

• Provide and maintain the LentloSites service
• Process payments and manage your subscription
• Send important service-related notifications by email, SMS and WhatsApp (see section 5a)
• Improve our product and user experience
• Respond to your support requests
• Detect and prevent fraud or abuse

Your data is stored on secure servers hosted in data centers with enterprise-grade security. We use encryption for all data in transit (TLS 1.3) and at rest. Passwords are stored using bcrypt hashing with 12 rounds of salting and are never stored in plain text. We conduct regular security reviews and follow industry-standard practices.

We do not sell your personal information — ever. We may share data with:

• Service providers: Payment processors (Razorpay, Cashfree, PayU, PhonePe, Easebuzz, Zoho Payments), cloud infrastructure (OVH — our main servers and a standby copy, in Mumbai, India; Cloudflare; Hetzner — a standby copy in Singapore), backup storage (DigitalOcean Spaces, Singapore), email/SMS delivery services (MSG91, SMSHorizon, Resend), WhatsApp message delivery through the WhatsApp Business Platform operated by Meta Platforms (see sections 5a and 5b), and AI model providers — DeepSeek (our main model) and OpenAI (used only when DeepSeek is unavailable) — only for the AI features a business chooses to switch on (see section 5b)
• Registrar partners: Namecheap, BigRock, or other ICANN-accredited registrar (when you receive a free domain under Pro plan — see /terms for agent-registration details)
• Legal requirements: When required by Indian law, court orders, or to protect our legal rights (we publish transparency on /grievance)

Websites you publish through LentloSites are publicly accessible by design. Any content you publish on your website will be visible to anyone who visits it. You are responsible for the content you publish and should not include sensitive personal information on public pages.

When you run a LentloSites account — as a website owner, a reseller or a team member — we may send you service messages on WhatsApp from our business number +91 95668 68777 (shown as "Lentlo"). These are transactional messages only — never marketing:

• What we send: Login codes and your sign-in link, alerts about your website (a new order, enquiry or booking, or a customer's wallet top-up waiting for your approval) and receipts and notices about your account
• Who it is for: Account holders only. Customers of websites built with LentloSites are not messaged from this number; a shop that connects its own WhatsApp Business number messages its customers from that number, under its own terms
• How Meta is involved: Delivery runs on the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates. Meta receives your phone number and the message content to deliver it, under WhatsApp's own privacy policy. We send only pre-approved message layouts
• Your choice: Reply STOP to any of these messages to opt out of every future message from this number; reply START to opt back in. Opting out never affects your order or booking itself
• What we keep: A record of each message (number, layout, delivery status and the words sent) for up to 12 months for support and compliance, after which it is deleted

A business on LentloSites can connect its own WhatsApp Business number to reply to its customers, send them order and booking updates, and send messages they agreed to receive. For that data the business decides why and how its customers' information is used — it is the Data Fiduciary. LentloSites processes the data only on the business's behalf, to run the service it asked for:

• How a number is connected: Either with access details the business creates in its own Meta account, or with "Continue with Facebook" (Meta's Embedded Signup). Through Facebook we receive only what Meta returns for the WhatsApp accounts the business chooses to share: an access token, the account and phone number IDs, and the business portfolio ID. We do not read or keep the person's Facebook profile, friends, posts or password
• What we process: The business's WhatsApp account and phone number IDs; its access token, stored encrypted; its message layouts (templates); its customers' WhatsApp numbers and profile names; the messages and media sent and received; delivery and read reports; and each customer's opt-in and opt-out record
• Why: Only to provide the business's inbox, its order and booking notifications, the broadcasts it sends, the automations it sets up and its WhatsApp account health. We never sell this data, never use it for our own marketing and never use it to train AI models
• Meta: Messages travel over Meta's WhatsApp Business Platform (Cloud API). Meta processes them under the WhatsApp Business terms and keeps Cloud API message data for up to 30 days to deliver it. The business keeps its own WhatsApp account and number, can see them in Meta's WhatsApp Manager, and pays Meta directly for WhatsApp's charges
• AI replies (optional): AI replies are off until a business switches them on. When it does, the customer's message, the business's own information (its products, prices, timings and frequently asked questions) and, for a business with an online store, that customer's own last three orders (order number, amount, status, courier tracking and how many days ago it was placed) are sent to an AI model provider — DeepSeek, our main model, or OpenAI when DeepSeek is unavailable — to draft an answer about that business only. The customer's phone number is not sent. Anything the AI cannot answer from that information is passed to the business. The business can switch AI replies off at any time
• Opt-out: A customer who replies STOP (or the same word in an Indian language) is not sent marketing again by that business; the record of the opt-out is kept so it keeps being honoured
• Retention and deletion: Conversations stay in the business's inbox while its account is open, so it can read its history. Disconnecting a number stops all sending at once; the access token is erased after 30 days, or at once with "Erase saved token now". Conversations are deleted when the business deletes them, when it asks us to, or within 30 days after its account is closed
• Customers' requests: A customer of a business should contact that business about its messages. If a customer writes to us instead, we pass the request to the business and help it respond within the time the law allows
• Moving to another provider: A business that moves its WhatsApp number to another provider keeps its WhatsApp account. On request we help it export its contacts (with their opt-in records), its layouts and its message history within 30 days, and then delete that data unless it asks us to keep it

You can delete your LentloSites account and its data at any time. If you connected a WhatsApp number with "Continue with Facebook", open Dashboard → WhatsApp → Settings, choose "Disconnect" and then "Erase saved token now" to remove the connection and its access token at once — or remove our app ("Lentlo WA") under Facebook → Settings → Business integrations. To delete everything, follow the steps at lentlosites.com/data-deletion or write to support@lentlosites.com from your registered email or phone number. We confirm every request and complete it within 30 days, keeping only what Indian law requires us to keep (for example tax invoices).

We use only the cookies necessary for authentication (keeping you signed in) and basic analytics. We do not use advertising cookies, cross-site tracking, or fingerprinting on the LentloSites marketing site. Sites you build on LentloSites may set their own cookies for e-commerce, analytics, or payment, as you configure. See our Cookie Policy at /cookies for the complete list. Emails that shops on LentloSites send to their customers (order, payment and booking emails) may carry a tiny invisible image and a button link that passes through our server, so the shop can see whether the email was opened and whether its button was tapped. For this we keep only the times and counts — not your IP address, device or location. Each shop can switch this off, and it is never added to sign-in or account-confirmation emails.

You have a range of rights over your personal data — see Section 11 below for the full list of DPDP Act 2023 rights. In summary, you can: access and download your data anytime, correct inaccurate information from your account settings, delete your account, export your website content before deletion, opt out of non-essential communications, and raise a grievance with our Data Protection Officer (see /grievance).

We retain your data for as long as your account is active. If you delete your account, we will permanently delete your personal data within 30 days. Website content is deleted immediately. Some data may be retained longer if required by Indian law (e.g., payment records for tax compliance). When we send you an account SMS (for example that your website is live), we keep the number and the message text for 90 days to check delivery, then remove them; you can switch these SMS off under Account.

LentloSites is not intended for individuals under 18 years of age. Under the DPDP Act 2023, we do not knowingly process personal data of children without verifiable parental consent. If you believe a child has provided us with personal information, please contact us at support@lentlosites.com and we will delete it immediately.

Your data is primarily stored and processed in India. Some service providers we use process data outside India: a standby copy of our database (Hetzner) and backups (DigitalOcean Spaces) are kept in Singapore; Cloudflare (content delivery, asset storage and the network in front of our servers) and Meta's WhatsApp Business Platform (message delivery) run worldwide, including in the United States; and, only when a business switches on AI features, the AI model providers process the text sent to them — DeepSeek in China and OpenAI in the United States. We ensure all such providers maintain equivalent data protection standards, and we do not transfer data to countries restricted by the Government of India.

As a Data Principal under India's DPDP Act 2023, you have the following rights:

• Right to access: Request a summary of the personal data we process about you, and the purposes
• Right to correction: Correct inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data when no longer needed (subject to legal retention requirements)
• Right to grievance redressal: Raise any grievance about our data processing (see our Grievance Officer page)
• Right to nominate: Nominate another person to exercise your rights in the event of your death or incapacity
• Right to withdraw consent: Withdraw consent at any time for any processing based on consent

We process your personal data under the following lawful bases:

• Consent: You consent when you create an account, accept these terms, or opt-in to specific features (e.g., marketing emails)
• Contractual necessity: We must process certain data to provide the service you have subscribed to
• Legitimate uses: Compliance with Indian law, response to government orders, protection against fraud, etc.
• Legal obligations: We retain invoices for 6 years (per CGST Act Section 36 — 72 months from annual return due date) and some identity/transaction records for the periods prescribed by applicable tax and financial regulations

We share personal data with a public authority only when the law requires it. For every such request:

• Legality: we check that the request is lawful and made by an authority entitled to make it before we act on it
• Challenge: we push back on, and where appropriate challenge, a request that is unlawful, too broad or not properly made
• Minimum data: we disclose only the minimum data the request lawfully requires
• Records: we keep a record of each request, our response, the legal reasoning and who handled it
• Notice: we tell the business or person concerned, unless the law forbids it

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify affected Data Principals and the Data Protection Board of India (once established and constituted) within the timeline and manner prescribed by the final DPDP Rules (currently being drafted). As a best practice and until those Rules are notified, we commit to notifying affected users within 72 hours of becoming aware of a material breach. The notification will describe the nature of the breach, likely consequences, and measures we are taking.

Lentlo is the Data Fiduciary for all personal data collected through LentloSites. For privacy-related queries:

• Designation: Data Protection Officer, LentloSites
• Email: support@lentlosites.com
• Response time: Within 15 days of receiving your request

We do not knowingly collect sensitive personal data such as health records, religious beliefs, political opinions, or biometric data. If you voluntarily include such data in your website content, you are responsible for compliance with applicable laws (e.g. if you run a healthcare site, you must comply with medical confidentiality standards).

We may update this privacy policy from time to time to reflect new services, regulatory changes (especially as DPDP Rules under DPDP Act 2023 are finalized), or user feedback. We will notify you of material changes via email or through the Service at least 30 days before they take effect. The "Last updated" date at the top indicates the most recent revision.