Privacy Policy

We collect the following types of information:

• Account information: Phone number, name, and email address when you register
• Website content: Pages, images, text, and settings you create using our builder
• Usage data: Pages visited, features used, and general activity on our platform
• Payment information: Billing details processed securely through Razorpay (we never store card numbers)
• Device information: Browser type, operating system, and IP address for security and analytics

We use your information to:

• Provide and maintain the LentloSites service
• Process payments and manage your subscription
• Send important service-related notifications by email, SMS and WhatsApp (see section 5a)
• Improve our product and user experience
• Respond to your support requests
• Detect and prevent fraud or abuse

Your data is stored on secure servers hosted in data centers with enterprise-grade security. We use encryption for all data in transit (TLS 1.3) and at rest. Passwords are stored using bcrypt hashing with 12 rounds of salting and are never stored in plain text. We conduct regular security reviews and follow industry-standard practices.

We do not sell your personal information — ever. We may share data with:

• Service providers: Payment processors (Razorpay, Cashfree, PayU, PhonePe, Easebuzz, Zoho Payments), cloud infrastructure (Cloudflare, Hetzner), backup storage (DigitalOcean Spaces), email/SMS delivery services (MSG91, SMSHorizon, Resend), and WhatsApp message delivery through the WhatsApp Business Platform operated by Meta Platforms (see section 5a)
• Registrar partners: Namecheap, BigRock, or other ICANN-accredited registrar (when you receive a free domain under Pro plan — see /terms for agent-registration details)
• Legal requirements: When required by Indian law, court orders, or to protect our legal rights (we publish transparency on /grievance)

Websites you publish through LentloSites are publicly accessible by design. Any content you publish on your website will be visible to anyone who visits it. You are responsible for the content you publish and should not include sensitive personal information on public pages.

When you run a LentloSites account — as a website owner, a reseller or a team member — we may send you service messages on WhatsApp from our business number +91 95668 68777 (shown as "Lentlo"). These are transactional messages only — never marketing:

• What we send: Login codes and your sign-in link, alerts about your website (a new order, enquiry or booking, or a customer's wallet top-up waiting for your approval) and receipts and notices about your account
• Who it is for: Account holders only. Customers of websites built with LentloSites are not messaged from this number; a shop that connects its own WhatsApp Business number messages its customers from that number, under its own terms
• How Meta is involved: Delivery runs on the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates. Meta receives your phone number and the message content to deliver it, under WhatsApp's own privacy policy. We send only pre-approved message layouts
• Your choice: Reply STOP to any of these messages to opt out of every future message from this number; reply START to opt back in. Opting out never affects your order or booking itself
• What we keep: A record of each message (number, layout, delivery status and the words sent) for up to 12 months for support and compliance, after which it is deleted

We use only the cookies necessary for authentication (keeping you signed in) and basic analytics. We do not use advertising cookies, cross-site tracking, or fingerprinting on the LentloSites marketing site. Sites you build on LentloSites may set their own cookies for e-commerce, analytics, or payment, as you configure. See our Cookie Policy at /cookies for the complete list. Emails that shops on LentloSites send to their customers (order, payment and booking emails) may carry a tiny invisible image and a button link that passes through our server, so the shop can see whether the email was opened and whether its button was tapped. For this we keep only the times and counts — not your IP address, device or location. Each shop can switch this off, and it is never added to sign-in or account-confirmation emails.

You have a range of rights over your personal data — see Section 11 below for the full list of DPDP Act 2023 rights. In summary, you can: access and download your data anytime, correct inaccurate information from your account settings, delete your account, export your website content before deletion, opt out of non-essential communications, and raise a grievance with our Data Protection Officer (see /grievance).

We retain your data for as long as your account is active. If you delete your account, we will permanently delete your personal data within 30 days. Website content is deleted immediately. Some data may be retained longer if required by Indian law (e.g., payment records for tax compliance). When we send you an account SMS (for example that your website is live), we keep the number and the message text for 90 days to check delivery, then remove them; you can switch these SMS off under Account.

LentloSites is not intended for individuals under 18 years of age. Under the DPDP Act 2023, we do not knowingly process personal data of children without verifiable parental consent. If you believe a child has provided us with personal information, please contact us at support@lentlosites.com and we will delete it immediately.

Your data is primarily stored and processed in India. Some service providers we use — Cloudflare R2 (asset storage), Cloudflare CDN (content delivery), and DigitalOcean Spaces (backup) — may process data in servers located outside India. We ensure all such providers maintain equivalent data protection standards, and we do not transfer data to countries restricted by the Government of India.

As a Data Principal under India's DPDP Act 2023, you have the following rights:

• Right to access: Request a summary of the personal data we process about you, and the purposes
• Right to correction: Correct inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data when no longer needed (subject to legal retention requirements)
• Right to grievance redressal: Raise any grievance about our data processing (see our Grievance Officer page)
• Right to nominate: Nominate another person to exercise your rights in the event of your death or incapacity
• Right to withdraw consent: Withdraw consent at any time for any processing based on consent

We process your personal data under the following lawful bases:

• Consent: You consent when you create an account, accept these terms, or opt-in to specific features (e.g., marketing emails)
• Contractual necessity: We must process certain data to provide the service you have subscribed to
• Legitimate uses: Compliance with Indian law, response to government orders, protection against fraud, etc.
• Legal obligations: We retain invoices for 6 years (per CGST Act Section 36 — 72 months from annual return due date) and some identity/transaction records for the periods prescribed by applicable tax and financial regulations

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify affected Data Principals and the Data Protection Board of India (once established and constituted) within the timeline and manner prescribed by the final DPDP Rules (currently being drafted). As a best practice and until those Rules are notified, we commit to notifying affected users within 72 hours of becoming aware of a material breach. The notification will describe the nature of the breach, likely consequences, and measures we are taking.

Lentlo is the Data Fiduciary for all personal data collected through LentloSites. For privacy-related queries:

• Designation: Data Protection Officer, LentloSites
• Email: support@lentlosites.com
• Response time: Within 15 days of receiving your request

We do not knowingly collect sensitive personal data such as health records, religious beliefs, political opinions, or biometric data. If you voluntarily include such data in your website content, you are responsible for compliance with applicable laws (e.g. if you run a healthcare site, you must comply with medical confidentiality standards).

We may update this privacy policy from time to time to reflect new services, regulatory changes (especially as DPDP Rules under DPDP Act 2023 are finalized), or user feedback. We will notify you of material changes via email or through the Service at least 30 days before they take effect. The "Last updated" date at the top indicates the most recent revision.