Privacy Policy

Last Updated: June 16, 2026

LUMSAS Nyro Website: https://lumsas.com/marketplace/nyro/ Contact: contact@lumsas.com Address: Midnapore, 721101, West Bengal

Last Updated: June 16, 2026 Effective Date: June 16, 2026

PREAMBLE

LUMSAS Nyro ("the Company," "we," "us," or "our") is committed to protecting the privacy and personal information of every individual who visits our website or uses our services. This Privacy Policy has been drafted in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

This document explains, in clear terms, what personal information we collect from you, why we collect it, how we use it, how we protect it, and what rights you hold over it. Please read this document carefully before using our services.

By visiting our website or purchasing a license from us, you confirm that you have read, understood, and agreed to the terms described in this Privacy Policy.

SECTION 1 — WHO WE ARE

LUMSAS Nyro is a software services company that enables artificial intelligence coding agents to build production-ready web applications correctly and efficiently. The Company provides licensed access to its proprietary system logics through its website at https://lumsas.com/marketplace/nyro/. The Company acts as the sole Data Fiduciary and Data Controller for all personal information collected through its platform.

For any privacy-related concerns or requests, you may reach us at:

Email: contact@lumsas.com

SECTION 2 — INFORMATION WE COLLECT

We collect only the minimum information necessary to provide our services to you. The categories of information we collect are as follows:

2.1 ACCOUNT INFORMATION

When you create an account with us, we collect your full name, your email address, and a password of your choosing. Your password is never stored in a readable form. It is converted into a secure, irreversible format before being saved in our systems.

2.2 PAYMENT INFORMATION

All payments made on our platform are processed by Razorpay, a licensed and regulated payment service provider in India. We do not collect, see, or store your credit card number, debit card number, bank account details, UPI credentials, or any other sensitive payment information. Upon completion of a successful payment, Razorpay shares only a transaction reference number and a payment confirmation status with us. For details on how Razorpay handles your financial data, please refer to Razorpay's Privacy Policy at https://razorpay.com/privacy/

2.3 DEVICE REGISTRATION INFORMATION

Our software requires that the license you purchase be bound to one specific computer at the time of activation. For this purpose, our software collects certain hardware characteristics of your computer to create a unique hardware fingerprint/machine identifier for that machine. This identifier is used solely to verify that the software is being used on the authorised registered computer. This hardware fingerprint is stored securely on our licensing servers for as long as your license remains active, solely for license verification. It is stored in a protected format and is not used to identify you as a person.

IMPORTANT: The hardware identifier collected at activation permanently and irrevocably binds your license to that specific computer. This binding is absolute and cannot be changed under any circumstances. Your license activates on one computer and stays there. This applies in all cases, including if the computer is lost, stolen, or stops working — there is no transfer or replacement activation.

2.4 SECURITY AND ACCESS LOGS

We maintain records of login activity on your account, including the date and time of logins, failed login attempts, and notifications of suspicious access events. These records exist solely to protect your account from unauthorized access.

2.5 COMMUNICATION RECORDS

If you contact us by email for support, refund requests, or any other purpose, we retain those communications for the purpose of resolving your query and maintaining a record of our interactions.

2.6 FRAUD DETECTION AND COMPLIANCE DATA

To protect the integrity of our Service and to prevent fraudulent transactions, we collect and process certain data for fraud detection and risk management purposes. This may include your IP address, the country of origin of your purchase, and the results of automated risk-scoring performed by Razorpay and Cloudflare. This data is processed on the lawful basis of legitimate interest to prevent financial crime and protect the Company's intellectual property.

2.7 USAGE AND ACTIVITY DATA

We may collect anonymised and aggregated usage and activity data through our Software, including the frequency and pattern of use of the Service, for the sole purpose of diagnosing technical issues and improving the quality of the Service. This data is collected in an anonymised form that cannot be linked back to you as an individual.

2.8 LOCAL EXECUTION AND CODE PRIVACY

The LUMSAS Nyro Software runs locally on your machine. We do not transmit, collect, or store your application code, project files, or development data on our servers.

SECTION 3 — HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes only:

(a) To create and manage your account with us;

(b) To issue your software license and activate your access to our services;

(d) To send you transactional emails, including your account creation confirmation, password reset instructions, important security alerts, and notifications regarding your license;

(e) To detect, prevent, and investigate fraud, unauthorized access, license misuse, and violations of our Terms of Service;

(f) To comply with our legal obligations under applicable Indian law, including responding to lawful orders from courts and government authorities;

(g) To maintain financial and transaction records as required under applicable Indian tax and commercial law.

We do not use your personal information for advertising, marketing profiling, behavioural tracking, or any purpose beyond what is listed above.

SECTION 4 — SHARING OF YOUR INFORMATION

We do not sell, rent, lease, or trade your personal information to any third party for any commercial or non-commercial purpose.

Your information is shared only in the following strictly limited circumstances:

4.1 SERVICE PROVIDERS

We engage certain third-party service providers who assist us in operating our platform. These providers process your data only on our instructions and are bound by confidentiality obligations. Our service providers include Razorpay (payment processing), Cloudflare (website infrastructure and security), and Resend (transactional email delivery).

4.2 LEGAL REQUIREMENTS

We may disclose your personal information if we are required to do so by a valid court order, statutory obligation, or lawful directive from a government authority under Indian law. We will, to the extent permitted by law, inform you of such a disclosure.

4.3 PROTECTION OF RIGHTS

We may disclose information where necessary to enforce our Terms of Service, to investigate suspected fraud or misconduct, or to protect the rights, property, or safety of the Company or its users.

4.4 BUSINESS SUCCESSION

In the event of a merger, acquisition, restructuring, asset sale, or other corporate transaction involving the Company, your personal data may be transferred to the successor entity as part of the transaction. You will be notified of any such transfer by email and on our website, and the successor entity will be bound by the obligations under this Privacy Policy.

4.5 FRAUD PREVENTION PARTNERS

We may share information — including email addresses, device identifiers, and payment reference numbers — with our payment processor Razorpay, and with other fraud prevention services we engage, for the purpose of identifying and preventing fraudulent transactions. Such sharing is carried out solely for the legitimate purpose of protecting our business and our users from financial crime.

4.6 ABSOLUTE PROHIBITION ON SALE OF DATA

UNDER NO CIRCUMSTANCES WILL THE COMPANY SELL, RENT, LEASE, AUCTION, OR TRADE YOUR PERSONAL DATA TO ANY THIRD PARTY FOR COMMERCIAL PURPOSES. THIS PROHIBITION IS ABSOLUTE AND APPLIES REGARDLESS OF ANY FUTURE CHANGES TO THE COMPANY'S BUSINESS MODEL OR OWNERSHIP STRUCTURE. ANY SUCCESSOR ENTITY THAT ACQUIRES THE COMPANY'S ASSETS WILL BE CONTRACTUALLY BOUND BY THIS PROHIBITION.

SECTION 5 — DATA STORAGE AND RETENTION

5.1 WHERE YOUR DATA IS STORED

Your data is stored on cloud infrastructure operated by third-party providers, which may involve servers located outside India. By using our services, you consent to the storage and processing of your data on such infrastructure, subject to applicable Indian law, including the Digital Personal Data Protection Act, 2023.

5.2 HOW LONG WE RETAIN YOUR DATA

We retain your data only for as long as it is necessary for the purposes described in this Policy or as required by applicable law. Specifically:

— Account and license data is retained for the duration of your active account and for three years following account closure.

— Financial transaction references are retained for seven years as required under applicable Indian financial and tax laws.

— Security and access logs are retained for two years.

— Email communications are retained for three years.

Upon expiry of the applicable retention period, your data will be deleted or anonymised in a secure manner.

NOTWITHSTANDING THE RETENTION PERIODS SET OUT ABOVE, THE COMPANY RESERVES THE RIGHT TO RETAIN YOUR PERSONAL DATA FOR LONGER PERIODS IF REQUIRED TO DO SO BY: (a) APPLICABLE LAW OR REGULATION; (b) A COURT ORDER OR LEGAL PROCESS; (c) THE INVESTIGATION OR PROSECUTION OF FRAUD, INTELLECTUAL PROPERTY INFRINGEMENT, OR OTHER ILLEGAL ACTIVITY INVOLVING YOUR ACCOUNT; OR (d) THE DEFENCE OF LEGAL CLAIMS BROUGHT BY OR AGAINST THE COMPANY. IN SUCH CASES, YOUR DATA WILL BE RETAINED ONLY TO THE EXTENT NECESSARY AND FOR THE DURATION OF THE RELEVANT LEGAL PROCESS OR OBLIGATION.

Notwithstanding any erasure request you may submit under Section 7 of this Policy, the Company will not delete data that it is required to retain by law or that it reasonably needs to retain for the purpose of defending itself against legal proceedings, including refund disputes and chargeback claims.

SECTION 6 — SECURITY OF YOUR INFORMATION

We take the security of your personal information seriously and implement commercially reasonable technical and organizational measures to protect it against unauthorized access, disclosure, alteration, or destruction.

These measures include secure encrypted storage of sensitive data, strict access controls limiting who within our organisation can access personal data, the use of secure and encrypted communication channels for all data transmissions, and regular monitoring for suspicious or unauthorized activity.

However, no method of electronic storage or transmission is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach that is likely to cause harm to you, we will notify you and the relevant authorities as required under applicable Indian law.

SECTION 7 — YOUR RIGHTS

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the following rights in relation to your personal data:

7.1 RIGHT TO ACCESS: You have the right to request a summary of the personal data we hold about you and the manner in which it has been processed.

7.2 RIGHT TO CORRECTION: You have the right to request that we correct any personal data we hold about you that is inaccurate, incomplete, or outdated.

7.3 RIGHT TO ERASURE: You have the right to request the deletion of your personal data, subject to our obligations to retain certain data under applicable law and subject to any outstanding license obligations.

7.4 RIGHT TO GRIEVANCE REDRESSAL: You have the right to raise a grievance with us regarding our data processing practices and to receive a response within a reasonable time.

7.5 RIGHT TO NOMINATE: You have the right to nominate another individual to exercise the above rights on your behalf in the event of your death or incapacity.

To exercise any of the above rights, please submit a written request to contact@lumsas.com. We will respond to your request within thirty (30) days of receipt, after verifying your identity.

SECTION 8 — COOKIES

We use only a strictly necessary session cookie to maintain your logged-in state while you use our platform. This cookie is essential for the website to function and is automatically deleted when you close your browser or log out of your account.

We do not use advertising cookies, tracking cookies, analytics cookies, or any other cookies that are not essential to the operation of the website.

SECTION 9 — MINORS

Our services are intended for individuals who are eighteen (18) years of age or older. We do not knowingly collect personal information from any person under the age of eighteen. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at contact@lumsas.com and we will take prompt steps to delete such information.

SECTION 10 — CHANGES TO THIS POLICY

We may revise this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last Updated" date at the top of this document and notify registered users by email. Your continued use of our services following such notification will constitute your acceptance of the revised Policy.

SECTION 11 — GRIEVANCE OFFICER AND CONTACT

In accordance with the Information Technology Act, 2000 and applicable rules, and the Digital Personal Data Protection Act, 2023, any grievances relating to the processing of your personal data may be directed to us at:

Email: contact@lumsas.com Website: https://lumsas.com/marketplace/nyro/

We are committed to resolving all grievances within thirty (30) days of receipt. If you are not satisfied with our resolution, you may approach the Data Protection Board of India constituted under the Digital Personal Data Protection Act, 2023.

SECTION 12 — LIMITATION OF LIABILITY FOR DATA PROCESSING

12.1 To the fullest extent permitted by applicable Indian law, the Company's liability to you in connection with any data breach, unauthorized disclosure, loss, or corruption of your personal data shall not exceed the amount actually paid by you to the Company for the Service.

12.2 The Company shall not be liable for any indirect, incidental, special, consequential, or punitive losses arising from any breach of this Privacy Policy, including but not limited to loss of business, loss of profits, loss of revenue, loss of data, or reputational damage, whether or not the Company was advised of the possibility of such losses.

12.3 The limitations in this Section 12 do not apply to losses caused by the Company's gross negligence or wilful misconduct, or to any liability that cannot be excluded or limited under the Digital Personal Data Protection Act, 2023 or any other applicable Indian law.

SECTION 13 — ACKNOWLEDGEMENT

BY USING OUR WEBSITE OR SERVICES, YOU IRREVOCABLY ACKNOWLEDGE THAT: (a) YOU HAVE READ THIS PRIVACY POLICY IN ITS ENTIRETY AND UNDERSTAND ITS CONTENTS; (b) YOU CONSENT TO THE COLLECTION, STORAGE, USE, AND PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS POLICY; (c) YOU UNDERSTAND THAT YOUR LICENSE ACTIVATES ON ONE COMPUTER AND STAYS THERE, AND THIS APPLIES IN ALL CASES, INCLUDING IF THE COMPUTER IS LOST, STOLEN, OR STOPS WORKING — THERE IS NO TRANSFER OR REPLACEMENT ACTIVATION; (d) YOU ARE EIGHTEEN (18) YEARS OF AGE OR OLDER; AND (e) YOU HAVE THE LEGAL CAPACITY TO GIVE CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA UNDER THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023.

GOVERNING LAW

This Privacy Policy is governed by and shall be construed in accordance with the laws of India. Any disputes arising hereunder shall be subject to the exclusive jurisdiction of the competent courts in India.