Privacy Policy
Lufer (“Lufer”, “we”) runs a marketplace where companies book corporate events and hospitality, and venues and partners supply them. This policy explains what personal data we process, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000.
1. Who is responsible
Lufer is the Data Fiduciary for personal data processed through lufer.app and our apps. Registered office: . Questions about this policy: privacy@lufer.app.
When a company uses Lufer to manage its own employees' or guests' data (for example a guest list), that company decides why the data is collected and we process it on its instructions.
2. What we collect
- Account details: name, work email, phone number, company or venue name, role, and your application to join.
- Business details: GSTIN, billing address, cost centres, budgets, purchase orders and approval settings.
- Event details: event requests, dates, headcounts, dietary and accessibility notes you enter, quotes, contracts and bookings.
- Guest data: names and email addresses of invitees added by an organiser, and their RSVP replies.
- Payment data: payment status, amounts and references. Card, UPI and bank details are entered with Razorpay and are never stored by us.
- Messages: chats with our AI concierge and messages sent through WhatsApp, Slack or email integrations you connect.
- Technical data: sign-in sessions, device and browser type, pages visited (in aggregate, without advertising cookies) and error reports.
3. Why we use it
- To run the service: sourcing venues, sending requests and quotes, routing approvals, confirming bookings and collecting RSVPs.
- To take payments, issue GST-compliant tax invoices, pay out venues and partners, and keep the tax records the law requires (including TCS under Section 52 of the CGST Act).
- To keep accounts secure, prevent fraud and abuse, and fix errors.
- To provide AI features, which send the text needed for a request (never payment details) to the AI providers listed below so they can return a response.
- To contact you about your bookings and account. We send marketing only with your consent, and you can opt out at any time.
We process personal data on the basis of your consent, given when you sign up or submit information, and for the legitimate uses the DPDP Act allows, such as complying with law, responding to legal orders and acting on information you have voluntarily provided for a purpose.
4. Who we share it with
We share booking details with the venue or partner you book, and with people in your company who need them to approve or pay (for example finance approvers). Venues never see your guest list. We do not sell personal data.
We use these service providers, who process data only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | India (Mumbai, AWS ap-south-1) |
| Vercel | Website and application hosting, privacy-friendly usage analytics | Global edge network; functions in the United States |
| Upstash | Caching, rate limiting and operational metrics | Cloud regions as configured |
| Razorpay | Payments, refunds and payouts to venues and partners | India |
| Google (Gemini), OpenAI, Anthropic, Groq | AI features: venue sourcing, quote drafting, the concierge, invoice reading | United States and other regions |
| Meta (WhatsApp Business), Twilio, Slack | Approval requests and notifications you choose to receive | United States and other regions |
| MapTiler | Maps on venue pages | European Union |
| Sentry | Error monitoring, with cookies, IP addresses and private link tokens removed | United States |
Some of these providers process data outside India. We transfer data only to countries not restricted by the Government of India under Section 16 of the DPDP Act. We may also disclose data when the law requires it.
5. How long we keep it
- Account, booking and guest data: for as long as your account is active, or until you or your company ask us to delete it.
- Tax invoices, payment and TCS records: for at least 72 months, as required by Section 36 of the CGST Act, even after an account is closed.
- Error and security logs: for a limited period, then deleted.
6. Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we hold about you and how it is processed;
- ask us to correct, complete, update or erase it;
- withdraw consent at any time (this doesn't affect processing already done, and we may need to keep some records by law);
- nominate someone to exercise these rights if you die or become incapacitated;
- have your grievances addressed by our Grievance Officer.
Email privacy@lufer.app from the address on your account. We respond within 30 days. If your company manages your data (for example as an invited guest), we may pass your request to them.
7. Grievance Officer
We acknowledge grievances within 24 hours and resolve them within 15 days. If you're not satisfied with our response, you can complain to the Data Protection Board of India.
8. Security
Data is encrypted in transit and at rest. Access is restricted by role and company, so one company cannot see another's data. We will notify you and the Data Protection Board of a personal data breach as the DPDP Act requires.
9. Cookies
We use only the cookies needed to keep you signed in and secure. Our usage analytics do not use cookies or track you across sites, and we do not use advertising cookies.
10. Children
Lufer is a business service for adults. We do not knowingly collect data from anyone under 18.
11. Changes
We'll post changes here and update the date above. For material changes we'll notify account holders by email before they take effect. See also our Terms of Service.