Effective 30 September 2026.
This policy describes every category of personal data the Lahore Traders buyer application collects — on iPhone, on Android and on the web — why it is collected, who it reaches, where it goes and how long it is kept. It is written to be read, not to be waved at. If something is not listed here, we do not collect it.
We do not sell your data. We do not share it for advertising. There is no advertising, no analytics SDK, no tracking pixel, no advertising identifier and no third-party marketing tool anywhere in this app. We do not track you across other companies' apps or websites.
It is written to meet the Digital Personal Data Protection Act, 2023 and the rules made under it, the Information Technology Act, 2000 and the rules made under it, and — for buyers outside India — the EU and UK General Data Protection Regulation and the privacy laws of the other places our buyers trade from. Where the law where you are gives you more than this policy does, you have it anyway.
LAHORE TRADERS, a partnership firm, of 42, 2nd Bhoiwada, Bihari Baug, Panjarpole, Bhuleshwar, Mumbai 400002, Maharashtra, India (GSTIN 27AAAFL2287L1Z1), decides why and how your data is used. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023, and the controller under the EU and UK GDPR and similar laws.
Anything to do with your data — a question, a correction, a copy, a deletion, a complaint, withdrawing a consent — goes to our Grievance Officer, Smayan Sachin Seth, at info@ltsbangles.com, or by post to the address above. That is also the contact for anyone who has a question about how we process personal data.
We acknowledge every request within 48 hours and answer it within 30 days. If a request is complex we may take longer where the law allows, and we will tell you why within the first 30 days.
This app is for trade buyers. It is not directed at the public and we do not knowingly hold data about anyone who is not dealing with us in the course of business.
| Data | Why we need it |
|---|---|
| Business name, owner or contact name, designation | To know who we are trading with, and who to ask for |
| Phone number | Sign-in by one-time code, order updates, and reaching you about a consignment |
| Email address | Sign-in by one-time code, and order and invoice correspondence |
| GST number or equivalent tax identifier | Statutory invoicing, and confirming you are a trade buyer |
| City, PIN or postal code, country | Freight quoting, and checking that the account is consistent |
| Delivery addresses, with the consignee name and phone on each | Dispatching your goods |
If you choose to sign in with Apple or Google (or Microsoft, on the web), that provider gives us your name and email address, and a unique identifier for your account with them. If you use Apple's "Hide My Email", we receive the relay address and never your real one. We never receive your password for any of these services.
Orders and their line items; quantities, sizes, finishes and prices; invoice numbers; payment status and the bank transaction reference (UTR) you give us; freight quotes; order-status history; the addresses used; and any note you attach to an order. This is the commercial record of our dealings with you. We keep it because tax law requires it, and because we cannot fulfil an order or resolve a dispute without it.
We never receive or store card numbers, UPI PINs, net-banking logins or any banking credential. Payment is by bank transfer from your own bank; we see only what reaches our account and the reference you give us.
Recently viewed designs and recent searches are erased the moment anyone signs out, so a shared handset never shows the previous person's activity to the next. On the web, the equivalents are held in your browser's local storage. We use no advertising or tracking cookies; the only browser storage the web app uses is what it needs to keep you signed in and to remember your theme.
To deliver the app and keep it secure we and our providers process ordinary technical records: the IP address a request comes from, timestamps, device type, app and operating-system version, and error information. Requests to our database and sign-in service are logged by our provider for security.
No background location and no location tracking. If you allow it when you register, the app reads your phone's location once, only to fill in your business address; that point is saved with the address and nothing else, and saying no changes nothing. No contacts. No microphone. The camera and your photo library are opened only if you tap the camera button in the search box to search with a photo, and only for the one picture you take or choose (clause 3.7). No advertising identifier. No cross-app or cross-site tracking. No browsing history outside this app. No health, financial-account, religious, political or other sensitive category of data.
No biometric data. The app does not use Face ID or fingerprint, and we never see, receive or store a fingerprint or a face.
Search runs on your phone first. To understand trade words and spellings the phone's search does not know, the words you type into the search box may be sent, with nothing else — no name, no account, no phone number, no address, no prices — to Google's Gemini service, which answers with what the words mean. Repeated searches are answered from a store of past answers that holds only the words, not who typed them.
If you search with a photo, the one picture you take or choose is sent to Google, again with nothing that identifies you, so that it can be compared with our product photographs. We do not keep your picture; it is not saved on our servers.
Because this uses Google's free service, Google's terms say it may review content sent to it and use it to improve its own products. So do not type or photograph anything confidential into the search box. Search will still work if you never use these features: the phone's own search needs none of this.
When you submit a registration we run automated checks to help judge whether an account is genuine. They use only the details you gave us:
| Check | What is sent, and to whom |
|---|---|
| Does your email domain exist and receive mail? | The domain part only (not your address) to Google Public DNS |
| Is the email from a disposable-inbox provider? | Nothing — checked against a list we hold |
| Does a business website exist at that domain? | A single request to that website's own address |
| Is the phone number consistent with the country? | Nothing — checked by us |
| Do the city and PIN code match? | The PIN code and country to Zippopotam.us, and the city name to the Open-Meteo geocoding service |
| Does this duplicate an existing account? | Nothing — checked in our own database |
None of these services receives your name, your phone number, your full email address or your GST number.
No account is ever rejected automatically. Where the checks are clear, an account may be approved automatically, at the standard tier. Everything else is decided by a person at Lahore Traders, and every rejection is made by a person. You may ask why an account was declined, and ask a person to look at it again.
| Purpose | Basis in India (DPDP Act 2023) | Basis under EU/UK GDPR |
|---|---|---|
| Registering and approving your account | Data you provided voluntarily for that purpose (s.7(a)) | Steps before entering a contract (Art. 6(1)(b)) |
| Taking, fulfilling, invoicing and delivering orders | Data provided voluntarily for that purpose (s.7(a)) | Performance of a contract (Art. 6(1)(b)) |
| Tax, GST, accounting and record-keeping | Compliance with law (s.7) | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, verifying accounts, protecting confidential pricing | Data provided for that purpose (s.7(a)) and compliance with law | Legitimate interests (Art. 6(1)(f)) |
| Order-update and video-call notifications | Your consent, given through your phone's permission prompt (s.6) | Consent (Art. 6(1)(a)) |
| News of new designs, restocks and offers, if you opt in | Your consent, given in the app and withdrawable in You → Preferences (s.6) | Consent (Art. 6(1)(a)) |
| Arranging and holding the video calls you book | Data provided voluntarily for that purpose (s.7(a)) | Steps before entering a contract (Art. 6(1)(b)) |
| Responding to your requests and complaints | Data provided for that purpose (s.7(a)) | Legal obligation and legitimate interests |
| Complying with a court order or a lawful demand of a government authority | Compliance with law (s.7) | Legal obligation (Art. 6(1)(c)) |
We do not use your data for any purpose not in this table. We will not use it for marketing without asking you first.
Where we rely on your consent you may withdraw it at any time, as easily as you gave it — turn notifications off in your phone's settings, or write to info@ltsbangles.com. Withdrawing consent does not affect anything done before you withdrew it. Some data cannot be removed on withdrawal because the law requires us to keep it; clause 8 says which.
Only where it is genuinely needed to run the app or to trade with you. Every provider below processes your data on our instructions and for our purposes, never for its own advertising.
| Who | What they process | Where |
|---|---|---|
| Supabase — database, sign-in and storage | Your account, orders, addresses, favourites, notification token | Mumbai, India |
| Twilio — sends sign-in codes by SMS | Your phone number and the code | United States and elsewhere |
| Resend — sends sign-in codes and email | Your email address and the message | United States |
| Expo (EAS) — delivers the app, its updates and notifications | Notification token and the notification content; technical data | United States |
| Apple and Google — deliver notifications to your device, and sign-in if you choose it | The notification; the identity they return to us | Per their own policies |
| Cloudflare — serves the web app and the product photographs | Technical request data | Global network |
| Cal.com — schedules the video calls you book, so no hour is ever given to two people, and emails you the confirmation | Your business or contact name, your email, the time you chose, and the WhatsApp number or Teams email and request you gave for the call | United States |
| Microsoft Teams — only if you choose a Teams call | The email we call and the call itself | Per Microsoft's own policies |
| Google Workspace — our email and calendar | Anything you email us; the calls you book appear in our calendar | Global |
| Google (Gemini) — understands search words and compares a search photo with our product photographs | Only the words you typed into search, or the one photo you chose (clause 3.7) | United States and elsewhere |
| Google Public DNS, Zippopotam.us, Open-Meteo — registration checks | Only what clause 4 lists | Global |
| WhatsApp (Meta) — only if we message or video call you there about an order or a call you booked | The message or call and your number | Per Meta's own policies |
| Your chosen carrier | Consignee name, address and phone, so the goods can be delivered | As applicable |
| Our bank | The payment you send, as it reaches our account | India |
| Our accountants, auditors and legal advisers | Only what a specific matter requires, under a duty of confidence | India |
| A court, regulator, tax or law-enforcement authority | Only what the law actually compels us to give | India, or as lawfully required |
If the business of Lahore Traders is ever transferred, reorganised or merged, the records needed to continue it pass to the successor, under this policy.
Some of the providers above process data outside India, so your data may be processed in the United States and elsewhere. India's DPDP Act permits this except to countries the Government has restricted, and we will not transfer data to any such country.
For buyers in the European Economic Area, the United Kingdom or Switzerland: your data is transferred to India, where we are, because that is where the business with you is done, and to the providers above. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) offered by those providers, or on another lawful transfer mechanism. You may ask us for a copy of the relevant safeguards at info@ltsbangles.com.
| Data | How long | Why |
|---|---|---|
| Orders, invoices, payment records, the tax trail | Eight years from the end of the financial year concerned | GST and income-tax law require it |
| Profile and addresses | While your account is open, then until any open order, dispute or legal obligation ends | To trade with you and to close out what is outstanding |
| Registration check results | While the account exists; deleted with it | To handle a re-application or a complaint |
| Notification token | Until you delete the account | To send order updates |
| Video call bookings | Until you delete the account; any call still to come is cancelled with Cal.com at the same moment. Cal.com keeps its own record of past calls under its policy | To hold the hour and to call you |
| Sign-in and security logs | As kept by our provider, generally not more than one year | Security |
| Emails you send us | As long as the matter needs, and the tax period where it concerns an order | Correspondence record |
| Data only on your phone | Until you sign out, clear the app's data, or uninstall | — |
We cannot delete tax records on request, and we say so plainly rather than promising an erasure we would not honour. When a retention period ends the data is deleted or irreversibly anonymised.
The app runs on a device we do not control, over networks we do not control. You are responsible for your own device, its passcode, your email account and phone number, who you allow to use them, and who in your business you give access to. You use the app at your own discretion, and to the extent the law allows we are not liable for loss arising from your device, your credentials, your email or phone account, or the acts of your own people.
No system is perfectly secure, and anyone who says otherwise is selling something. We take the measures above and keep them under review.
If a personal data breach occurs, we will inform the affected people without delay, in plain language — what happened, what it may mean for them, what we are doing, and what they can do — and we will report it to the Data Protection Board of India as the DPDP Act and its rules require, including a detailed report within 72 hours of becoming aware of it. Where the GDPR applies we will also notify the competent supervisory authority within 72 hours. These duties are statutory; they sit with us, and nothing in any of our documents limits them.
Wherever you are, you may ask us to:
Deleting your account is built into the app — You → Delete Account. It removes your sign-in, profile, addresses, favourites and notification tokens. Invoices and order records are kept for the statutory period in clause 8; the screen tells you so before you confirm.
Write to info@ltsbangles.com. We may need to confirm your identity before acting, so that nobody else can obtain or change your data by asking. We do not charge for a request, and you will never be treated differently for exercising a right.
Under the DPDP Act you also have the right to nominate someone to exercise your rights if you die or become incapable, and the right to grievance redressal — first by us, and then, if you are not satisfied, by complaint to the Data Protection Board of India. Please come to us first; the Act asks you to.
You also have the right to restrict processing, to object to processing based on legitimate interests, to data portability, and to complain to your data protection supervisory authority.
We do not sell or share personal information for cross-context behavioural advertising, and have not done so in the past 12 months. Residents of California and other US states with privacy laws may ask to know, access, correct and delete their personal information, and to appeal a refusal, by writing to info@ltsbangles.com. We do not use or disclose sensitive personal information for any purpose that would give a right to limit it. We do not respond to "Do Not Track" signals because we do no tracking for one to stop.
This app is for businesses and for adults acting for them. It is not available to anyone under 18, and we do not knowingly process the personal data of a child. If you believe we hold such data, write to us and we will delete it.
We update this policy when what we do changes. The effective date at the top tells you which version you are reading. We tell you in the app before a material change takes effect, and where a change needs your consent we ask for it. Earlier versions are kept and available on request.
Grievance Officer — Smayan Sachin Seth, LAHORE TRADERS info@ltsbangles.com · 42, 2nd Bhoiwada, Bihari Baug, Panjarpole, Bhuleshwar, Mumbai 400002, Maharashtra, India Acknowledgement within 48 hours · Answer within 30 days