Privacy Policy

Last updated: 28 September 2026

This Privacy Policy describes how Lumina Labs ("Company", "we", "us", or "our") collects, uses, stores, and protects your personal data when you use the letshangout.co website, mobile application, and related services (the "Platform"). This policy is published in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000.

By using the Platform, you consent to the collection and processing of your personal data as described in this Privacy Policy.

1. Data Fiduciary

Lumina Labs is the Data Fiduciary (as defined under the DPDP Act) responsible for processing your personal data. Our contact details:

Email: privacy@letshangout.co
Grievance Officer: Deepak — grievance@letshangout.co

2. Personal Data We Collect

2.1 Data you provide directly

2.2 Data collected automatically

2.3 Data we do NOT collect

• We do not collect precise GPS location without explicit consent;
• We do not collect financial data, payment details, or bank information (the Platform is currently free);
• We do not collect Aadhaar numbers or government ID numbers unless you opt in to ID verification;
• We do not read your contacts, messages, or call logs.

3. Purpose of Processing

We process your personal data for the following specific, lawful purposes:

• Account creation and authentication — verifying your phone number via OTP;
• Profile display — showing the display name you choose, your age, profession and photo to other users on Plans. Your real name, phone number and email are never shown;
• Plan discovery — matching Plans to users based on neighbourhood and category preferences;
• Identity verification and trust — checking the LinkedIn, Instagram or Twitter/X profiles you choose to add, to confirm you are a real person, and — only if you turn on "show on my profile" — showing them to other signed-in members on your plans and join requests;
• Safety and moderation — investigating reports, enforcing community guidelines, and preventing misuse;
• Ratings — displaying aggregate ratings to help users make informed decisions;
• Security and fraud prevention — rate-limiting sign-ups, detecting fake or duplicate accounts, and protecting the Platform and its users;
• Legal compliance — meeting our obligations under applicable law, responding to lawful requests from authorities, and establishing, exercising or defending legal claims;
• Platform improvement — analysing anonymised usage data to improve features and fix bugs;
• Communication — sending essential notifications about your Plans (join requests, approvals, updates);
• Updates and invitations — contacting you by WhatsApp, SMS, email or phone about our launch in your area, new features, Plans and events near you, and requests for feedback. You can stop these at any time (see Section 4).

We will not process your personal data for any purpose other than those stated above without obtaining your separate consent.

4. Consent

In accordance with Section 6 of the DPDP Act, we obtain your free, specific, informed, unconditional, and unambiguous consent before processing your personal data. You provide consent by:

• Joining the waitlist (consent to us storing your name, phone number, email and neighbourhood, and to contacting you for the purposes in Section 3, including updates and invitations);
• Creating an account (consent to account and profile data processing);
• Connecting social profiles (consent to verification data processing);
• Creating or joining Plans (consent to Plan data processing).

You may withdraw your consent at any time by emailing privacy@letshangout.co from the phone number or email linked to your account, asking us to delete it. We will confirm and delete your account and personal data within 30 days, except where retention is required by law. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To stop updates and invitations only, reply to any of our messages asking us to stop, or email privacy@letshangout.co, and we will stop sending them.

5. Data Sharing

We share your personal data only in the following circumstances:

• With other users: Your profile information (the display name you choose, age, profession, photo, neighbourhood, rating) is visible to other users when you join or host Plans. Your real name, phone number, email and verification details are never shared with other users. Your social profile links are shared with other signed-in members only if you turn on "show on my profile";
• Service providers: We use Supabase (database and authentication), Vercel (hosting), Google Analytics (aggregate usage statistics — which pages are visited, from what kind of device and roughly where), ImprovMX (forwarding emails you send to our @letshangout.co addresses to our inbox), Resend (sending our emails to you, such as your waitlist confirmation), and MSG91 with its captcha provider hCaptcha (sending and checking the one-time code you log in with). These processors are bound by data processing agreements;
• Legal requirements: We may disclose your data if required by law, court order, or government authority, or to protect the rights, property, or safety of the Company, users, or the public;
• Safety: We may share data with law enforcement if we believe a user poses a threat to the safety of others.

We do not sell your personal data. We do not share your data with advertisers or data brokers.

6. Data Storage & Security

• Your data is stored on servers managed by Supabase, with data centres in the Asia-Pacific region;
• All data is encrypted in transit (TLS/HTTPS) and at rest;
• Access to personal data is restricted to authorised personnel on a need-to-know basis;
• We implement reasonable security practices and procedures as required under Section 8 of the DPDP Act and Rule 8 of the IT (Reasonable Security Practices and Procedures) Rules, 2011.

7. Data Retention

• Active accounts: Data is retained for as long as your account is active;
• Deleted accounts: Upon account deletion, your personal data is deleted within 30 days, except where retention is required by law;
• Plans and ratings: Anonymised Plan data and ratings may be retained for platform integrity;
• Reports: Safety reports may be retained for up to 3 years for legal and safety purposes;
• Waitlist: Waitlist details are kept until you ask us to delete them or we close the waitlist, except where retention is required by law;
• Security records: Hashed IP records are kept only as long as needed to prevent abuse.

8. Your Rights (Data Principal Rights under DPDP Act)

Under the DPDP Act, you have the right to:

• Access: Request a summary of your personal data and processing activities;
• Correction: Request correction of inaccurate or incomplete data;
• Erasure: Request deletion of your personal data (subject to legal retention requirements);
• Withdraw consent: Withdraw consent for any processing at any time;
• Grievance redressal: File a complaint with our Grievance Officer or the Data Protection Board of India;
• Nominate: Nominate another individual to exercise your rights in case of death or incapacity.

To exercise any of these rights, contact us at privacy@letshangout.co. We will respond within 30 days.

9. Children's Data

The Platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete such data promptly.

10. Cookies & Tracking

The Platform uses essential cookies for authentication and session management. We also use Google Analytics, which sets its own cookies (named _ga and _ga_*) to count visits and understand how the Platform is used. This data is aggregate and is not used for advertising; we have not enabled Google advertising features. You can block these cookies in your browser, or opt out with Google's browser add-on, without affecting how the Platform works. We do not use advertising cookies or cross-site trackers.

11. Data Breach Notification

In accordance with the DPDP Act, in the event of a personal data breach that is likely to cause harm to Data Principals, we will:

• Notify the Data Protection Board of India as required by law;
• Notify affected users without undue delay;
• Take immediate steps to mitigate the breach and prevent recurrence.

12. Cross-Border Data Transfer

Your data may be processed in countries outside India where our service providers operate. Such transfers are made in compliance with Section 16 of the DPDP Act and only to jurisdictions not restricted by the Central Government.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or email. Your continued use of the Platform constitutes acceptance of the updated policy.

14. Grievance Officer

In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

Name: Deepak
Email: grievance@letshangout.co
Response time: Acknowledgement within 24 hours; resolution within 15 days.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

15. Contact

For questions about this Privacy Policy, contact us at privacy@letshangout.co.