GDPR Notice

This notice applies to residents of the European Union, European Economic Area (EEA), the United Kingdom, and other territories where the General Data Protection Regulation (GDPR) or UK GDPR applies.

Under GDPR, you have the following rights:

Right of Access (Article 15)

You may request a copy of all personal data we hold about you and how we process it.

Right of Rectification (Article 16)

You may request correction of inaccurate or incomplete personal data.

Right to Erasure / Right to Be Forgotten (Article 17)

You may request deletion of your personal data, except where we have a legal obligation to retain it (e.g., tax records).

Right to Restrict Processing (Article 18)

You may request that we limit how we process your data (e.g., stop sending marketing emails while we investigate a dispute).

Right to Data Portability (Article 20)

You may request your data in a structured, machine-readable format (e.g., CSV, JSON) to transfer to another service.

Right to Object (Article 21)

You may object to processing based on legitimate interest, including automated profiling and marketing.

Rights Related to Automated Decision-Making (Article 22)

You have the right to opt out of decisions made solely by automated means that produce legal or similarly significant effects.

To exercise any of the above rights, contact us:

• Email: privacy@lokly.in
• In-App: Settings → Privacy & Security → Data Subject Request

Include your full name, email address, and a clear description of your request. We will respond within 30 days (or 60 days for complex requests).

Note: We may ask you to verify your identity for security purposes before fulfilling your request.

We process your data based on the following lawful grounds:

• Contract: To provide the Service (Article 6(1)(b))
• Legitimate Interest: To improve the Service, prevent fraud, and protect our systems (Article 6(1)(f))
• Legal Obligation: To comply with tax laws and legal requests (Article 6(1)(c))
• Consent: For optional analytics and marketing (Article 6(1)(a))

Data may be transferred from the EU/EEA to India and the US for processing (e.g., Supabase, Google Gemini). These transfers are safeguarded by:

• Standard Contractual Clauses (SCCs): EU-approved contractual safeguards with our processors
• Adequacy Decisions: Where applicable (e.g., for EU-US transfers via Stripe, Vercel)

By using Lokly, you consent to these transfers. SCCs are available upon request.

If you have concerns about how we handle your data, you have the right to lodge a complaint with your national data protection authority:

• EU: Your country’s Data Protection Authority
• UK: Information Commissioner’s Office (ICO)

For EU/EEA residents, the cookie banner on our website allows you to grant or withdraw consent for non-essential cookies. You can change your choices at any time via the banner or in Settings.

We retain personal data for as long as necessary to provide the Service and comply with legal obligations:

• Account data: While your account is active, plus 6 months after deletion
• Usage data: 24 months for analytics
• Payment data: 7 years (required by tax law)

For complete details, see our Privacy Policy.

Questions about your GDPR rights?

• Data Protection Officer: privacy@lokly.in
• Legal inquiries: legal@lokly.in