Privacy Policy

1. Introduction

1.1. This Privacy Policy forms a part of the User Terms and Conditions (hereinafter "T&C") of Lytho Technologies (OPC) Private Limited, (collectively, "Lytho Technologies", "we", "our", or "us") operating mobile application, web portal, website, and any associated upgrades, patches, updates, and related services (collectively referred to as the "Platform"). The entity accessing or using the Platform shall be referred to as the "Client", "Customer", or "you". We value and respect your privacy and are committed to protecting the information collected through the Platform. This Policy applies to all information collected via the Platform. This Privacy Policy explains how we collect, use, store, and disclose information obtained through the Platform. By accessing the Platform, you acknowledge that you have read and understood this Privacy Policy and the User Terms.

1.2. The Platform serves two types of users: Clients (business entities) and Admin. Each role may have specific data collected, stored, and processed depending on its interactions with the Platform. The Platform is intended primarily for use by business entities and their authorised representatives.

1.3. This Privacy Policy explains how we collect, use and share your Personal Information (defined below). We may update this Privacy Policy from time to time. Any material changes will be reflected by updating the effective date or by providing notice where required by applicable law. Your continued use of the Platform and our services after any changes to this Privacy Policy and the Terms of Service shall constitute acceptance of the changed policies and you shall be bound by such changes. You are encouraged to review the Privacy Policy whenever you access the Platform to make sure that you understand how any personal information you provide will be used.

1.4. This Privacy Policy is only applicable to the Platform and is not applicable to any external websites, including social media websites such as Facebook, LinkedIn, Instagram, or other third-party websites, which maintain their own privacy policies.

2. Statutory Compliance

2.1. This Privacy Policy ("Policy") is published in accordance with the provisions of:

1. Section 43A of the Information Technology Act, 2000;
2. Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPI Rules");
3. Rule 3(1) of the Information Technology (Intermediaries Guidelines) Rules, 2011;

This Policy is also intended to align with applicable data protection requirements under the Digital Personal Data Protection Act, 2023, where relevant.

2.2. This Policy outlines the type of information collected from users ("Users"), including the nature of sensitive personal data or information, the purpose of collection, the manner and modes of usage of such information, and the circumstances under which such information may be disclosed.

2.3. This Policy constitutes an "electronic record" within the meaning of Section 2(t) of the Information Technology Act, 2000 and the applicable rules thereunder.

2.4. Being generated by a computer system, this electronic record does not require any physical or digital signature.

3. User Information Collected

3.1. Personal Data

Personal Data refers to limited business contact information that may be used to identify or communicate with a user in a business context. Such information may include:

1. first name
2. last name
3. business email address
4. company name
5. contact number or other contact information (where required)
6. any information voluntarily provided by you when submitting an enquiry, requesting a demo, or communicating with us.

We do not intentionally collect sensitive personal data or unnecessary personal information through the Website forms. You have the option not to provide such information; however, certain services (such as demo requests or enquiries) may not be available without it.

If you are providing any User information on behalf of any corporation, company, institution, association or other entity, you represent that you are authorised by such entity to provide such information to the Company.

3.2. Usage Data

We may collect information that your browser sends whenever you visit our Platform or access our services through any device ("Usage Data"). Usage Data may include:

1. IP address
2. browser type
3. browser version
4. pages visited
5. date and time of visit
6. time spent on pages
7. device identifiers
8. operating system information
9. diagnostic or performance data

This information helps us operate the Platform, maintain security, analyse usage trends, and improve our services.

3.3. Cookies

a) Cookies and browser/device storage support sign-in, security, encryption access and your preferences. Public sharing stores a random identifier to remember guest seller blocks. These functional identifiers are not used to track you across other companies' apps or websites.

b) You can control cookies and clear local storage through your browser or device. This may sign you out, remove local preferences or reset guest seller blocks. Lytho does not use advertising pixels or cross-app advertising tracking in these app and public-sharing flows.

3.4. Information Provided by Users Voluntarily

The information that you shall provide as feedback, suggestions, ideas, or enquiries may also be collected by us. To protect your privacy, you may choose not to provide us with certain information; however, this might result in your inability to use our Platform or certain features thereof.

3.5. Passive Information

Service providers may process request information such as IP addresses, timestamps and error responses to operate and secure the service. This is distinct from optional app analytics. iOS builds that show crash reporting as unavailable in Settings do not initialize optional crash collection. Earlier iOS builds and Android builds may send crash reports unless disabled in Settings → Privacy. Diagnostic events may include account and company identifiers and error details; we do not describe them as anonymous. Optional usage analytics are not implemented in the current app or portal.

3.6. Optional AI image processing

When you choose AI stone identification or AI document scanning, Lytho sends the entire selected image through its server-side AI service to Google Gemini. Stone identification returns a suggested material identification; document scanning extracts truck and consignment details. A document or photo can contain names, contact information, addresses, people and other visible details. This processing takes place outside the encrypted inventory store.

The app asks separately for stone-photo and document-image permission before the first upload on the device. You may decline and use manual entry. You can stop future uploads in Settings → Privacy → AI stone identification or AI document scanning. Withdrawal cannot recall an image already sent. Only send images you have permission to share. Google processes submissions under the Gemini API terms; processing and retention depend on the configured service tier. We do not promise that AI processing is zero-retention or end-to-end encrypted.

3.7. Deliberately published content

Public sharing and showcases publish the selected text, seller contact details and selected media so recipients with the link and any required access code can view them. Before a new or changed publication becomes viewable, selected public photos and text (including seller contact details and text visible in photos) are sent to Google Cloud Vision and Cloud Natural Language for automatic safety checks. Publishing asks for this processing explicitly; cancelling keeps the content private. A failed or incomplete check does not make the content public. Public video publishing remains unavailable in this release. These public snapshots and their media are outside Lytho's private-inventory encryption boundary. Private inventory is not made public solely because it exists in your account.

Google Cloud processes these submissions under its Cloud Privacy Notice and the applicable service terms. Removing a publication stops future access through Lytho but cannot recall copies already downloaded or content already sent for processing.

Revoking a link prevents new access through Lytho, but cannot recall copies recipients have already saved. Existing signed media links may continue to work until their expiry. Public-share access checks use limited security request data to enforce access codes and abuse limits. Reports are received in a private Lytho operator queue and may retain the reported public content for investigation. Blocking a seller hides their listings for your signed-in account; guest blocks use a random browser or device identifier and last up to 90 days. Clearing guest storage resets that local identity. Account-bound blocks are deleted with the authentication account. You can unblock a seller from a blocked listing.

4. Use of Information

4.1. We use information that we collect about you or that you provide to us, including any personal information:

1. Create, manage, and verify Client accounts.
2. Enable subscription activation, billing, and payment processing.
3. Facilitate in-platform communication, support tickets, and integration management.
4. Send confirmations, invoices, reminders, or Platform updates.
5. Ensure compliance with Platform's Terms and Conditions and applicable law.
6. Provide, operate, maintain, and improve the Platform and related services.
7. Notify users about changes to the Platform, services, terms, or policies.
8. Maintain the security, integrity, and proper functionality of the Platform.
9. Enable access to features and functionalities of the Platform.
10. Communicate with users regarding operational or service-related matters.
11. Perform analytics for product improvement and user experience enhancement.
12. Detect and prevent fraud or unauthorised access.
13. Comply with legal obligations and regulatory requirements, including under the IT Act, DPDP Act, and applicable GST legislation.
14. Conduct internal research on demographics, interests, and usage behaviour to better understand and serve our clients.
15. Request ratings and feedback.
16. For any legal requirement, such as but not limited to investigations against crimes, illegal activity, suspected fraud, or violation of the Platform's Terms of Service and Privacy Policy.
17. Allow us to pursue available remedies or limit the damages that we may sustain.
18. Process and perform the contract between the Platform and you regarding the delivery of the Services.
19. Improve our customer service and therefore record all communication between the Platform and you.
20. Retain your Personal and Passive Information for the purposes of legal compliance and business requirements, such as to maintain business records for a particular period of time.
21. Collect billing information using third-party intermediary service providers. The Platform does not process payments directly nor store payment card information. The third-party service providers and intermediaries are not permitted to store, retain, or use your personal information for any purpose other than payment processing and fulfilment; and
22. Serve marketing or promotional communications only where you have opted in and provide an easy opt-out mechanism in every such communication.

4.2. You are responsible for maintaining the confidentiality of your login credentials and for all activities carried out under your account. In accordance with applicable cybersecurity practices and the guidance issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act, 2000, including the CERT-In Advisory dated 10 November 2022 on password management, the Platform may enforce minimum password complexity requirements and periodic credential updates.

4.3. You are responsible for access to your devices, and it is your responsibility for all the activities that shall occur under your account. The Platform shall not be held liable or responsible for any information that is released by you on your own volition or that is released to any third party to whom you gave access.

5. Whom and How We Share the Collected Information

5.1. We may share your Personal Information only with authorised third-party service providers, subject to this Privacy Policy and T&Cs, and shall exercise reasonable care to protect your Personal Information as described in this Privacy Policy. We may share the Personal Information with:

1. Authorised Company personnel who have access to the Personal Information on a need-to-know basis;
2. Third-party service providers, including but not limited to payment processors, cloud hosting providers, analytics providers, customer support tools, and technology vendors, who assist us in operating and providing our Platform. Such service providers are permitted to use Personal Information only to the extent necessary to provide services on our behalf or comply with legal obligations.
3. Law enforcement or regulatory authorities, as required by applicable law.
4. Admin users of the Platform, to access account and transactional data, facilitate approvals, process refunds, investigate complaints, and ensure Platform compliance.
5. We do not sell, trade, or rent your Personal Information to any third party.
6. In the event of a reorganisation, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings), we may transfer the Personal Information which we have collected to the relevant third party in order to give effect to such transaction; and
7. We may share the Personal Information with entities, authorities, or individuals in accordance with applicable law to help detect and prevent any illegal activity or abuse of the Platform.

5.2. We may sometimes avail services from service providers situated outside India. When we do, we take reasonable steps to ensure they handle Personal Information in a manner broadly consistent with this Privacy Policy and applicable Indian law.

6. Data Storage

6.1. The Platform may store your Personal Information using secure servers or other hosted technology. Your information may also be stored in cloud storage and other such storage technology to share the information with third-party service providers for the purposes enumerated in this Privacy Policy.

6.2. Communications and data shared through the Platform may be retained as required for operational, audit, or compliance purposes.

7. Data Security

7.1. We value the security of your Personal Information and shall take appropriate and adequate organisational, technical, and administrative measures to secure and safeguard your data, including to:

1. Protect user data from unauthorised access or disclosure.
2. Secure communication and transactions using industry-standard encryption protocols including end-to-end encryption where applicable; and
3. Ensure data stored on third-party cloud services is protected contractually.

7.2. The Platform will use standard data security protocols and mechanisms while exchanging and transferring data, and endeavours to ensure that our third-party service providers employ industry-standard security measures through legally binding terms and conditions.

7.3. Unfortunately, the transmission of information via the internet and mobile platforms is not completely secure. ALTHOUGH WE DO OUR BEST TO PROTECT YOUR PERSONAL INFORMATION, WE CANNOT GUARANTEE THE SECURITY OF YOUR PERSONAL INFORMATION TRANSMITTED THROUGH OUR APP. ANY TRANSMISSION OF PERSONAL INFORMATION IS AT YOUR OWN RISK. WE ARE NOT RESPONSIBLE FOR CIRCUMVENTION OF ANY PRIVACY SETTINGS OR SECURITY MEASURES WE PROVIDE.

7.4. If you are provided with any User ID, password, OTP or any other piece of information as part of the Platform's security procedure, You shall treat such information as confidential and not disclose it to any third-party including other Users.

7.5. To prevent any third party from accessing Your User Account and User Information, You should log out from the User Account after availing the services through the Platform. We have the right to disable the User Account, at any time, if You fail to comply with instructions or terms, conditions or policies of the Platform. It shall be Your responsibility to always protect your login credentials and not disclose them to anyone. We are not liable for misuse of Your login credentials. The User Account holder will be solely responsible for any activity conducted through their account. In case of suspected abuse of your account, please let us know as soon as possible and change your (login) details.

7.6. We urge you to be careful about giving out information in public areas of the Platform. The information you share in public areas may be viewed by any user of the App.

7.7. Notwithstanding anything contained in this Policy or elsewhere, We shall not be held responsible for any loss, damage or misuse of Your User Information, if such loss, damage or misuse is attributable to a Force Majeure Event. A "Force Majeure Event" means any event that is beyond Our reasonable control and includes, without limitation, fire, flood, explosion, acts of God, civil commotion, strikes, lock outs or industrial action of any kind, riots, insurrection, war, acts of government, power failure, sabotage, computer hacking, unauthorized access to computer data and storage device, system failure, virus, attacks, bugs, computer crashes, breach of security and encryption.

8. Retention and Disposal of Data

8.1. We retain personal information as long as necessary for:

1. Providing our Services.
2. Complying with legal requirements, and
3. Resolving disputes or enforcing agreements.

8.2. You can request account deletion or a personal data export from Settings in Lytho, or contact info@lytho.co.in from your registered address. Our support team handles requests within 30 days and confirms completion. A request does not immediately delete your account. Shared company records and sole-owner transfer or company-deletion choices require separate verification. We cannot decrypt protected company records for an export. See our account deletion and export process for details. Any residual data in backups or logs is subject to applicable retention policies.

9. Contact Information

9.1. If you have any questions, queries, comments, or requests regarding the Privacy Policy, you are welcome to contact us at:

1. Email: info@lytho.co.in
2. Entity Name: Lytho Technologies (OPC) Private Limited
3. Registered Address: 33, Kanchan Village, R K Girl College, Madanganj Kishangarh, Kishangarh, Ajmer- 305801, Rajasthan

10. Minor's Use

Our Platform is intended for use by business entities and their authorised representatives. It is not intended for use by individuals under the age of 18. We do not knowingly collect data from minors. If we become aware that such data has been collected inadvertently, we will take reasonable steps to delete it promptly.

11. User Rights and Consent Withdrawal

11.1. You may have certain rights with respect to your Personal Information processed by the Platform, including the following:

1. Review and update your information;
2. Revoke consent for data processing; and
3. Delete your account or request erasure of data, subject to legal retention obligations.

11.2. You may withdraw consent for the collection and processing of your Personal Information by notifying us at admin@lytho.co.in. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal.

11.3. If You choose not to provide us with consent or withdraw consent at any given point in time, this may affect our ability to provide certain Services, and we shall not be able to provide Services as per the T&Cs and this Privacy Policy.

12. Third-party Links and Websites

12.1. Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. If you decide to visit a third-party website, you are subject to the privacy policy of the third-party website as applicable, and we are not responsible for the policies and practices of the third-party website. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services. The Platform does not control how third-party websites collect or use information once you leave our Platform. The Company shall not be responsible for any data collection, usage, or disclosure carried out by such third parties.

12.2. The mobile app does not display personalized third-party advertisements or use advertising tracking. External links have their own privacy practices as described above.

13. Non-Waiver

13.1. Any failure to exercise or delay in exercising any right, power, privilege, or remedy available to the Platform under this Privacy Policy shall not constitute a waiver of such right, nor shall any single or partial exercise of any right, power, remedy, or privilege preclude any other or further exercise thereof.

14. Changes to Privacy Policy

14.1. We may update this Privacy Policy from time to time, with or without prior notice. Material changes shall be notified to Clients via email or through a prominent notice on the Platform at least thirty (30) days prior to the effective date. Continued use of the Platform after such updates shall constitute acceptance of the modified Privacy Policy.

15. Governing Law and Jurisdiction

15.1. The Platform and any contracts concluded or entered as a result of usage of the Platform are governed by applicable laws in India and subject to the exclusive jurisdiction of the competent courts at Pune, Maharashtra.