Privacy Notice

DRAFT — prepared with AI assistance, not reviewed by a lawyer. Do not publish before legal review.

Version: 0.1 (draft) · Last updated: [date of publication] · Effective from: [date of publication] Available in: English (this version) and Hindi. If the two differ, [LAWYER: choose which version prevails].

This notice explains what personal data LAMP collects about you as an Owner or Staff member, why, who else sees it, how long we keep it, and how you can control it. It stands on its own: you do not need to read any other document to understand it.

1. The short version

• Who we are. LAMP is run by Agentic Genie LLP, an Indian limited liability partnership. When this notice says "LAMP", "we" or "us", it means Agentic Genie LLP.
• Your LAMP account is ours to protect. You have one LAMP identity, even if you work with several businesses on LAMP. For that identity (your name, mobile number, email, sign-in details and security logs) we decide how the data is used, so we are responsible for it. In law we are the Data Fiduciary for it.
• Your business's data belongs to the business. Invoices, customers, suppliers, stock, payroll and chat about the business are held by LAMP on behalf of that business. For that data the business is responsible, and we only act on its instructions. In law we are its Data Processor. Questions about that data go to the business first (section 8).
• What we do not do. We do not sell your personal data. We do not show you advertising. We do not use content that arrives through WhatsApp to improve LAMP for anyone other than the business it came from.
• Your choices. You can see, correct and delete your data, withdraw consent, and name someone to act for you. Write to our Grievance Officer (section 16). We acknowledge within 24 hours.

2. Who this notice covers

This notice covers you if you are:

• an Owner of a business that uses LAMP, including the Account Holder who manages the subscription and billing;
• a Staff member whom a business has invited to LAMP;
• someone who joins a waitlist, asks for a demo, or writes to us.

It does not govern how a business uses the personal data of its own customers, suppliers, job-workers or employees inside LAMP. That business decides, and its own privacy notice applies. Section 8 explains our part.

LAMP is for adults. You must be 18 or older to hold a LAMP account. We do not knowingly create accounts for anyone younger. If you believe a child has an account, tell the Grievance Officer and we will close it.

3. Our two roles, in one table

One identity across businesses

A person can work with more than one business on LAMP, for example an accountant who serves several clients, or an Owner with two firms. You keep one LAMP identity for all of them. That is why your identity data is ours to look after, not any single business's.

What each business can see:

• your name, the identifiers you use to sign in, and the Roles that business has given you;
• what you do inside that business, recorded in its Audit Log.

What a business cannot see: whether you belong to any other business on LAMP, or anything you do there.

4. What we collect about you

We collect only what we need to run your account and keep it safe. Items marked (SPD) are "sensitive personal data" under India's IT Rules 2011, and section 6 explains the extra consent we ask for them.

We do not collect Aadhaar numbers, biometrics, health data, or your personal contacts list, for your account. Full card numbers and bank passwords are handled by the payment gateway, not by us.

Messages you send in a Channel (Telegram, web chat, WhatsApp) about the business's work are business data (section 8). We keep the technical record that a message was sent, from which account and when, as part of item 5.

5. Why we use it

How quality monitoring and evals protect you

LAMP's agents draft documents and messages, and at the Auto level they send them. To keep that work correct we check it continuously. The rules we follow:

• Masked by default. Before anyone at LAMP reviews a conversation or turns it into a test case, names, numbers, addresses, GSTINs, bank details and amounts are replaced with placeholders or realistic fake values.
• Unmasked access is the exception. A LAMP reviewer sees unmasked data only to fix a specific problem, with a recorded reason, and every such access is written to a log.
• Shared test cases contain no real personal data. Test cases used across all businesses are masked or synthetic. Unmasked cases stay within the one business they came from.
• WhatsApp content is never used for shared learning. Anything that reached LAMP through WhatsApp is never used in shared test cases, shared Playbooks, or any learning across businesses. Meta's terms forbid it, and we tag every item with the Channel it came from so this is enforced by our systems.
• No training of general AI models. We do not use your data to train general-purpose AI models, and we use AI providers under terms that do not allow them to train on what we send (section 9).

What we will not do

• Sell or rent your personal data.
• Use it for advertising or share it with advertisers.
• Use your account data to judge you as a worker. LAMP measures the quality of its own work by task type, not the performance of individual people. [LAWYER: confirm this matches the product before publishing.]

6. Sensitive personal data and your consent

India's Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 treat passwords (your PIN and sign-in codes) and financial information (payment details) as sensitive. Before we collect them we ask for your consent in writing. Electronic consent counts.

• How you give it. When you first set your PIN, and when the Account Holder first adds a payment method, LAMP shows a short consent message with a link to this notice. You agree by confirming (a button, or a "yes" reply in the Channel). We record the date, time, Channel and notice version.
• What you are agreeing to. That Agentic Genie LLP, at [registered address], collects and keeps these items for the purposes in section 5, shares them only with the recipients in section 9, and keeps them only as long as section 10 says.
• If you say no. You can still use sign-in methods that do not need a PIN (a Telegram code or an email code), where your business has enabled them. Without a payment method the business cannot move to a paid plan.
• Withdrawing it. See section 12.

7. AI agents and messages sent in the business's name

LAMP's agents read the business's data and draft quotations, invoices, reminders and replies. Depending on the Autonomy Level the Owner sets for each kind of work, an agent either prepares a draft for a person to confirm (Ask) or does the work and reports it (Auto).

• Messages to customers and suppliers go out in the business's name. The business is responsible for them.
• Email to customers and suppliers. A quotation, acknowledgement or other Document a person at the business confirms is emailed to the contact email the business recorded for that customer or supplier, from LAMP's sending address in the business's name, with the Document attached where there is one. Nothing goes to any other address. The email is kept in the business's records as it was sent, and the email provider in our Sub-processor list carries it. A quotation email carries a link to that quotation alone, which works without an account until the quotation expires; when it is opened and how it was answered are kept in the business's Audit Log, and the words of an answer go only to the people at the business who follow the quotation up. A payment reminder or a dispatch notice goes only to the customer the invoice was issued to, with the invoice attached where it has been printed, and carries a link to that invoice's PDF alone, which works without an account for 180 days; each time it is opened is kept in the business's Audit Log.
• Every document records which version of LAMP's templates and instructions produced it.
• Every Channel has a way to reach a person at the business. [Product: confirm the "talk to a person" command before publishing.]
• No decision with legal or similar effect about you personally is made by an agent without a person at the business being able to review it.

8. Business data: we act for the business

For business data, the business (the Tenant) is the Data Fiduciary and LAMP is its Data Processor. In practice:

• The business decides what data goes into LAMP, why, and for how long, and it must tell the people concerned. We give businesses a notice template for their customers and Staff.
• We follow the business's instructions, under a written Data Processing Addendum that requires us to protect the data, keep it confidential, help the business answer rights requests, tell it quickly about any breach, and return or delete the data when it leaves.
• If your request is about business data, for example "delete my number from this supplier's records", send it to that business. If you send it to us, we will pass it to the business within 72 hours and tell you we have done so.
• Tax records are kept as the law requires. A business must keep its GST records until 72 months after the due date of its annual return for that year. Records it needs for that, such as the name and GSTIN on an issued invoice, cannot be erased on request until that period ends. Other details, such as notes or chat history, can be.
• Our own limited purposes. The Data Processing Addendum lets us use business data for a few purposes of our own: security, abuse prevention, masked quality monitoring and evals (section 5), and aggregated statistics that identify no person or business. For those uses we are responsible to you directly, under this notice. WhatsApp content is excluded from all of them except security.

9. Who receives your data

We share personal data only with the recipients below, and only what each one needs.

Service providers (sub-processors)

The current list, with any changes, is kept at [URL of the sub-processor list]. We tell Account Holders at least [30] days before we add a new sub-processor that receives personal data.

Others

• The businesses you belong to see the data described in section 3.
• Professional advisers (lawyers, auditors, chartered accountants), under confidentiality, when they need it to advise us.
• Government, courts and regulators, when the law requires, for example a lawful order or a CERT-In direction. Where the law allows, we will tell you.
• A buyer or successor of LAMP's business, if LAMP is merged, sold or restructured. They must keep to this notice or give you a new one.

Data that leaves India

LAMP's database and files are stored in India. Some providers above work outside India: AI model providers, Telegram, Meta and possibly email. Indian law allows such transfers except to countries the Government restricts, and we will stop any transfer to a restricted country. We choose providers whose contract terms protect data to a standard at least equal to ours and do not let them train their models on our data. We do not offer an India-only model option on the shared service. A business that needs every step inside India can ask about an on-premises or own-cloud deployment.

10. How long we keep it

If an investigation, dispute or legal proceeding is open, we may keep the data it needs until it ends.

11. Your rights, and how to use them

How to make a request

1. In LAMP: open your profile in web chat ([Settings → Privacy]) or send "privacy" to LAMP in any Channel. [Product: build before publishing.]
2. By email: write to [email] from the email address on your account.
3. By post: Grievance Officer, Agentic Genie LLP, [registered address].

Tell us the mobile number or email address registered with LAMP, so we can find your account, and what you want. We confirm it is you by sending a one-time code to that number or email. We will not ask for Aadhaar or other documents unless we truly cannot confirm who you are another way.

A person you nominate, or someone with your written authority, can make a request for you. We will ask for proof of that authority.

Timelines. We acknowledge every request within 24 hours and aim to complete it within 15 days. We always complete it within the time the law allows. There is no fee.

12. Withdrawing consent

You can withdraw consent as easily as you gave it: through [Settings → Privacy], by sending "withdraw consent" in any Channel, or by email to [email].

• Withdrawal stops future processing that relies on consent. It does not undo what was lawfully done before.
• We will stop within [7] days and confirm to you.
• Some things do not depend on consent alone. We must still keep security logs and billing records for the periods in section 10.
• If you withdraw consent for your account data, we cannot keep your account open, because we cannot sign you in without it. We will tell you this first and offer to delete the account.
• You can withdraw from optional uses, such as product news, while keeping your account.

13. Deleting your account

• Staff member: ask any Owner of the business to remove you, or delete your LAMP identity yourself through [Settings → Privacy] or by email to [email]. Deleting your identity removes you from every business you belong to, so we confirm this with you first.
• Owner: you can leave a business if another Owner remains. The Account Holder closes the business's subscription under the Terms of Service. The business then has 30 days to export its data.
• What happens next. We close your sign-in methods at once. We erase your account data within [30] days, except what section 10 says we must keep. Your name on past actions in a business's Audit Log is replaced with a pseudonym where the law allows. We confirm when deletion is complete.
• WhatsApp and Telegram. Deleting your LAMP account does not delete your WhatsApp or Telegram accounts or the copies of messages kept on your phone. Those are governed by their own terms.

14. How we protect your data

In summary (we describe it in more detail to businesses under our Data Processing Addendum):

• Data is encrypted in transit and at rest. PINs are stored only as one-way hashes.
• Each business's data is kept separate from every other business's by database controls, and every software change is tested against leaks between businesses.
• Staff at LAMP get the least access they need. Access to unmasked data is recorded and reviewed.
• Logs are kept, monitored and reviewed, and systems are backed up.
• Sign-in is protected with verified identifiers, one-time codes and lockouts after repeated failures.
• We have an incident plan. We report serious incidents to CERT-In within 6 hours. If a breach affects you, we tell you without delay what happened, what it means for you and what you can do. From the DPDP commencement date we also report it to the Data Protection Board.
• Our security programme is written to map to ISO/IEC 27001. We are not certified yet and will say so until we are.

No system is perfectly secure. If you notice something wrong, tell us at [security email].

15. Cookies

Our website and web chat use only the cookies needed to sign you in, keep your session secure and remember your language. [If analytics cookies are added, list them here and ask for consent first.]

16. Grievance Officer and contact

Grievance Officer and contact for data protection questions [Grievance Officer name], Agentic Genie LLP Email: [email] · Phone: [phone] Address: [registered address]

The same details, and how we handle complaints, are on our Contact and grievances page.

• We acknowledge every complaint within 24 hours, aim to resolve it within 15 days, and always resolve it within the time the law allows.
• If you are not satisfied with our answer, you can complain to the Data Protection Board of India once the relevant provisions of the Digital Personal Data Protection Act, 2023 are in force (expected from about 13 May 2027). The law asks you to come to us first.

17. Laws this notice follows

Today: the Information Technology Act, 2000 and the SPDI Rules, 2011; the CERT-In Directions of 28 April 2022; and, as a precaution, the grievance duties of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. From their commencement: the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Most duties begin around 13 May 2027. We already follow them where we can.

18. Changes to this notice

• Every version has a number and date. Past versions are listed below and kept at [URL].
• If we change what we collect, why, or who receives it, we tell you in your Channel and by email before the change takes effect, and ask for fresh consent where the law requires.
• When the DPDP Rules take effect (around 13 May 2027), we will send everyone who joined before then a fresh notice in their Channel, as the law requires, with a link to the updated notice and a simple way to withdraw consent.