Privacy Policy
Privacy Policy
This policy explains what personal data LoomLane collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it.
It covers everyone who uses LoomLane — buyers, sellers, members of the Business Women affiliate programme, and visitors to our websites — and it applies across the LoomLane marketplace app, the seller app, our websites, and any store-branded app powered by LoomLane.
LoomLane is operated by LOOMLANE TECHNOLOGIES LLP (LLPIN ACY-4991), registered at H.No.2-2-647/77/G- 24,23,Flat No. 3A, A R Elegance,Amberpet,Hyderabad,Telangana,India-500013. In the language of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here — meaning we decide why and how it is processed, and we are answerable for it.
If a store-branded app brought you here: that store is the shopfront you are buying from, and LoomLane operates the platform behind it. LoomLane processes your data as described in this policy in both cases.
1. What we collect
1.1 Things you give us
| Data | When | Why |
|---|---|---|
| Mobile number | Sign-in | It is your account identity, and how we send you a one-time password |
| Name | Profile, checkout | So a seller and a courier know who the parcel is for |
| Email address | Profile (optional) | Order receipts and account notices, if you give us one |
| Delivery addresses | Checkout, address book | To deliver what you ordered |
| What you tell support | When you contact us | To answer you, and to keep a record of the complaint |
| Photographs you upload for virtual try-on | When you use try-on | To generate the try-on image you asked for — see §4 |
| Photos and text you post in community spaces | When you post | To show them to the people you posted them to |
1.2 Things sellers and affiliate members give us
If you sell on LoomLane or join the Business Women programme, we additionally collect what the law requires us to hold about a business or an earner: identity and address documents, PAN, GST registration where applicable, bank account details for settlement, and business details. Some of this is verified through regulated third parties.
1.3 Things that happen as you use LoomLane
| Data | Why |
|---|---|
| Orders, returns, refunds, payment status | To run your orders and keep the records a business must keep |
| What you browse, search, save and tap | To make what we show you more relevant to you |
| Wallet balance, gift cards, referral activity | To operate credits, gifts and rewards |
| Conversations with Meera, our styling assistant | To answer you, and to remember context within a conversation |
| Device and app information, IP address, approximate location derived from it | Security, fraud prevention, diagnosing faults |
| Delivery pincode and serviceability checks | To tell you honestly whether we can deliver to you |
| A picture of the app screen, only when the app crashes, and only while we have switched this on to investigate a specific fault | To see what the screen actually looked like when something broke — see §4a |
1.4 What we do not collect
We do not ask for or read your precise GPS location. We do not read your SMS messages, call logs, or calendar. We do not collect your card number, UPI PIN, or net-banking credentials — those go directly to our payment gateway and never reach our systems. We do not buy personal data about you from data brokers.
1.5 Contacts, if you choose to share them
Members of the Business Women programme may choose to bring in contacts from their phone in order to reach the people they already sell to. This is optional and off unless you turn it on. If you do, please only add people who would expect to hear from you. Anyone whose details reach us this way can ask us to remove them — see §8 — and we will, whether or not they use LoomLane.
2. Why we use it, and on what basis
Under the DPDP Act we process your personal data either because you consented, or because it is necessary for a legitimate use the Act recognises — such as doing the thing you asked us to do.
| What we do | Why we are allowed to |
|---|---|
| Create and secure your account, send OTPs | Necessary to give you the service you asked for |
| Take orders, arrange delivery, handle returns and refunds | Necessary to perform your order |
| Take payments and settle sellers | Necessary to perform your order; and legal obligation |
| Keep tax, GST and accounting records | Legal obligation |
| Verify seller and affiliate identity | Legal obligation, and preventing fraud |
| Answer your questions and complaints | Necessary to give you the service; and legal obligation for grievances |
| Show you more relevant sarees | Your consent, which you can withdraw |
| Virtual try-on and other AI features | Your consent, given specifically before your photo is used |
| Marketing messages | Your consent, which you can withdraw at any time |
| Detect fraud and abuse, keep the platform safe | Our legitimate use in preventing harm |
| Diagnose crashes, including a masked screenshot while an investigation is running (§4a) | Necessary to give you a working service — keeping the app usable is part of what you asked us for |
We do not sell your personal data. We do not use your photographs or your purchase history to train third-party AI models.
3. Who we share it with
We share only what is needed, only with those who need it, and only for the purposes below.
| Who | What they get | Why |
|---|---|---|
| The seller you ordered from | Your name, delivery address, phone number, order contents | They cannot pack and dispatch a parcel otherwise |
| Delivery partners | Name, address, phone, parcel details | To deliver to you and to call you when they arrive |
| Payment gateway (Razorpay) | Order value, contact details, and whatever the payment flow requires | To take payment and settle sellers |
| Communication providers (SMS, WhatsApp, push) | Phone number or device token, message content | To send OTPs, order updates, and messages you asked for |
| Support desk software | Your contact details and the substance of your query | To track and answer your complaint |
| Cloud hosting and storage | The data described in this policy, encrypted in transit | To run the service |
| AI providers | The specific content of the request — e.g. a photo for try-on, a question for Meera | To produce the result you asked for. Providers are bound not to use it to train their models |
| Identity-verification and KYC providers | Seller and affiliate identity documents | To meet legal verification requirements |
| Professional advisers, auditors, insurers | Only what the engagement requires | Legal and accounting obligations |
| Government, courts, law enforcement | What we are lawfully required to give | Legal obligation |
If our business is ever sold or reorganised, personal data may transfer to the acquirer, who would remain bound by this policy or one that protects you at least as well. We would tell you before that happens.
4. Photographs and AI features
Virtual try-on lets you see how a saree might look on you. It works by sending an image to an AI provider that generates a try-on picture.
- We ask first. Before your first try-on, we ask for your consent specifically, and we record it. You can withdraw it at any time.
- You control the photos. Photos you upload for try-on are visible only to you unless you deliberately share a result. You can delete a photo, or a whole person profile you set up for try-on, from within the app.
- Providers do not train on your photos. Our agreements with AI providers prohibit using your content to train their models.
- Generated images are yours. A try-on result is stored so you can come back to it, and deleted when you delete it or when you delete your account.
- It is an approximation. A try-on image is a computer's guess at how a fabric might fall. It is not a photograph of the actual product, and colour and drape will differ in real life.
Meera, our styling assistant, remembers the conversation you are having so it can be useful across a few messages. You can clear that history from the app.
4a. Crash screenshots
When the app breaks, the most useful thing we can have is a picture of what the screen looked like at that moment. Some faults cannot be diagnosed any other way — the person affected often cannot reproduce the problem or describe it, and a written error message does not say what they were looking at.
Because a picture of your screen is more sensitive than the rest of what we collect, we hold it to tighter rules than anything else in this policy:
- It is off by default. We do not collect screenshots as a matter of course. The capability stays switched off, and we turn it on deliberately, for a limited period, when we are investigating a specific fault. Most people will never have one taken.
- Only on a crash. A screenshot is captured only alongside an error report, never during ordinary use, never on a schedule, and never because of what you are doing or looking at.
- Text and images are hidden before it leaves your device. The picture is processed on your phone or browser first, so that text and photographs on the screen are covered over. What we receive is essentially the layout — where things sat — rather than what they said. This is done automatically and we do not receive an unmasked copy.
- It is not linked to your name. Crash reports do not carry your account, your name or your number. A screenshot arrives attached to a fault, not to a person.
- We keep it for 30 days, the same as the crash report it belongs to, after which it is deleted automatically.
- It is never public. Screenshots are stored privately, are not served from any public address, and can be opened only by staff investigating faults, through short-lived links.
We can also switch this off everywhere at once, without waiting for an app update, and we do so as soon as an investigation is finished.
The honest limit. The masking covers text and images. Something drawn on screen in an unusual way — a live camera preview, an embedded map, an external web page inside the app — may not be covered by it. We take that into account before switching screenshots on for any part of the app, and we do not switch it on for screens where it would be a poor trade.
5. How long we keep it
We keep personal data for as long as your account is open and you are using LoomLane, and after that only where we have a specific reason to.
| Kind of record | How long |
|---|---|
| Account and profile | While your account is open |
| Orders, invoices, payments, refunds | After your account closes, for the period Indian tax, GST and corporate law require these records to be retained |
| KYC and verification records for sellers and affiliates | For the period the applicable verification law requires |
| Support tickets and grievance records | For the period required to evidence complaint handling |
| Try-on photos and generated images | Until you delete them, or your account closes |
| Community posts | Until you delete them, or your account closes |
| Browsing and personalisation signals | For a rolling recent window; older signals are aggregated or deleted |
| Security and fraud logs | For a limited period proportionate to the risk |
| Crash reports, and any masked screenshot attached to one (§4a) | 30 days, then deleted automatically |
When a retention period ends, we delete the data or remove everything that identifies you, so that what remains cannot be traced back to you.
If a dispute, investigation or legal claim is live, we may need to keep the relevant records until it is resolved, even if you have asked us to delete them. We will tell you when this applies to you.
6. Where your data is held
We host LoomLane on cloud infrastructure and store data in the region our provider operates for us. Some of our service providers — particularly AI providers and communication platforms — may process data outside India. Where that happens, we rely on contractual protections with those providers and transfer only what the specific service requires.
7. How we protect it
We encrypt data in transit. Passwords are stored hashed, never in readable form. Access to production systems is restricted to people who need it, requires additional verification for sensitive actions, and is logged. Payment credentials never touch our servers. Sensitive credentials are held in a managed secret store.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that puts you at risk, we will notify you and the Data Protection Board as the law requires.
8. Your rights
Under the DPDP Act you can ask us to:
- Tell you what personal data of yours we hold and who we have shared it with.
- Correct anything inaccurate, incomplete or out of date.
- Delete your personal data, where we have no legal reason to keep it.
- Withdraw consent you previously gave — for marketing, for personalisation, for try-on — as easily as you gave it.
- Nominate someone to exercise these rights for you if you die or become incapable of exercising them yourself.
- Complain to us, and then to the Data Protection Board of India if we do not resolve it.
How to exercise them. The fastest route is in the app: Profile → Settings. Account deletion is available there directly. For anything else, write to us at hello@loomlane.org or contact our Grievance Officer (§10). We will respond within the timelines the law sets, and will tell you if we need to verify who you are first.
What deletion does and does not do. Deleting your account removes your profile, addresses, saved items, try-on photos, community posts and personalisation history. It does not remove the record of orders you have already placed, because tax and accounting law requires us to keep those — but we remove what identifies you from them where we lawfully can. It does not withdraw a consent you gave to terms that governed a completed transaction.
Please keep the information you give us accurate, and do not submit anyone else's personal data unless you are entitled to.
9. Children
LoomLane is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us and we will delete it.
10. Grievances and how to reach us
We take complaints seriously and we answer them.
- Grievance Officer — the designated officer's name, email, phone and office hours are published on our Grievance Redressal page, kept current there so it is never out of date in a document.
- General privacy questions — hello@loomlane.org
- Post — LOOMLANE TECHNOLOGIES LLP, H.No.2-2-647/77/G- 24,23,Flat No. 3A, A R Elegance,Amberpet,Hyderabad,Telangana,India-500013
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
11. Changes to this policy
When we change this policy we publish a new version with a new effective date, and the previous versions stay available at their own permanent links so you can see exactly what applied when. If a change materially affects you, we will tell you in the app or by message, and where the law requires it, ask for your consent again.
The version you are reading is identified by the version label and effective date shown with it.
Permanent link to this version (v1.0): https://loomlane.org/legal/privacy/v1.0