Privacy Policy

This explains what personal data we collect, why, who we share it with, and what you can ask us to do about it. It is written to meet India's Digital Personal Data Protection Act, 2023.

1. Who is responsible

Lightworkz Media is the Data Fiduciary for the data described here. You can reach us at hello@lightworkz.in or on 8838190703.

2. What we collect, and why

When you ask for a free audit

• Your business name, category, and a description if you give one
• Your name, role, email address and phone number
• The social profile links you choose to share
• Any brand files you upload

We use this to prepare your audit, to contact you about it, and to set up your account if you go ahead.

What we read from your social profiles

We read only what is already public. For YouTube we use the YouTube Data API to fetch public channel and video statistics. We never ask for your account passwords and we cannot see anything private. Instagram and Facebook can only be read where the profile is a public Page or a business or creator account.

The result is stored against your record so your team can measure growth from it.

When you become a client

• Contact details for the people we deal with
• Your plan, subscription and billing history, including invoices and payments
• Brand assets and files you upload
• Messages you send us in the portal chat
• Deliverables, your approvals and any change requests

When you use the portal

• Your email address and an authentication identifier, so you can sign in
• The date and time you last signed in
• A record of which version of our Terms and Privacy Policy you accepted, and when

We keep an audit log of significant actions taken in the system, such as publishing an invoice or accepting a deliverable, together with who did it and when. This is how we stay accountable to you.

We do not collect payment card numbers. Where online payment is available, you enter those details with our payment provider and they never reach us.

3. Our legal basis

We process this data because you gave us your consent during onboarding, and because we need it to perform the contract between us. Some records, invoices in particular, we keep because the law requires it.

4. Who we share it with

We do not sell your data. We share it only with the providers that run the service:

Some of these providers operate outside India. Where that happens, the transfer is only to countries permitted under the DPDP Act.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

5. Files and access

Files you upload are stored in a private bucket. They are not publicly readable and cannot be reached by guessing a URL. Every request for a file is checked against your session and your permissions at the moment you ask for it, so access stops the moment it should.

6. How long we keep it

• Account and project records: for as long as you are a client, and for three years after, so we can answer questions about work we did
• Invoices and payment records: eight years, as tax law requires
• Audit logs: three years
• Audits for prospects who never became clients: two years, then deleted
• Files you upload: until you ask us to delete them, or the retention period above ends

7. Your rights

Under the DPDP Act you can:

• See what we hold. Download everything we have about you from the portal, under "Your data and privacy". It arrives as a JSON file covering your contacts, plan, invoices, tasks, chat messages and shared documents.
• Correct it. Tell us and we will fix anything inaccurate or incomplete.
• Have it erased. Request deletion from the portal. We will act on it, except for records we are legally required to keep, such as invoices. We will tell you what we kept and why.
• Withdraw consent. You can withdraw it at any time. Doing so may mean we can no longer provide the service.
• Nominate someone. You can name a person to exercise these rights for you if you are unable to.
• Complain. If we have not put something right, you can raise it with the Data Protection Board of India.

We respond to requests within 30 days.

8. Keeping it safe

Sign-in is handled by Google Firebase. Sessions are held in a cookie your browser cannot read from scripts, and access is revoked immediately when someone leaves, not whenever their session happens to expire. Files sit in a private bucket and are checked on every request. Traffic is encrypted in transit.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

9. Cookies

We use exactly two, and neither is for tracking:

• lw_session, which keeps you signed in. It lasts five days and your browser's scripts cannot read it.
• lw_lead, set only if you start the onboarding funnel, so we know which draft belongs to your browser and nobody else can pick it up. It lasts a week.

We run no advertising, analytics or tracking cookies of any kind, and no third-party tracking scripts.

10. Children

The service is for businesses. We do not knowingly collect data about anyone under 18. If you believe we have, tell us and we will delete it.

11. Changes

We may update this policy. When we do, we publish a new version here and ask you to accept it the next time you sign in. The version in force is always the one on this page.

12. Contact and grievances

For anything about your data, including a complaint, write to hello@lightworkz.in and mark it for the attention of our Grievance Officer. We will acknowledge within seven days and respond within 30.