Legal
Privacy Policy
Effective date: 26 October 2026 · Version 1.0
Summary
- We collect your email, profile details, UPI ID, optional phone and PAN, your recordings and transcriptions, and basic technical data.
- Customers receive only your recordings with a random speaker ID, age band, gender, state, district and dialect — never your name, email, phone, UPI ID, PAN or exact age.
- We do not sell personal data for advertising and do not use advertising trackers.
- You can access, correct and erase your data, withdraw consent and nominate someone, at any time.
- Questions or complaints: privacy@lootbeez.shop or our Grievance Officer.
This Privacy Policy explains how LootBeezShop (“LootBeez”, “we”, “us”) processes personal data when you use the LootBeez website, web app and mobile app (the “Platform”). For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, LootBeez is the Data Fiduciary for the personal data described here, and you are the Data Principal.
Scope
This policy applies to Contributors, Reviewers, Coordinators, Business Customers and visitors to our website. It does not apply to websites or services of third parties that we link to.
Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, login timestamps, preferred language, referral code used | You |
| Profile data | Full name, age, gender, state, district, dialects spoken, optional mobile number | You |
| Payment and tax data | UPI ID, PAN (only when required for tax), payout amounts and UTR references | You; our payment records |
| Contributions | Voice recordings, transcriptions, and the prompts you responded to | You |
| Quality data | Audio measurements (loudness, silence, clipping, duration), review outcomes and reasons, quality level, training-test score | Generated by the Platform and Reviewers |
| Consent records | Consent version accepted, date and time, IP address at acceptance | Generated when you consent |
| Technical data | IP address, device and browser type, app version, error logs | Your device; our hosting provider |
| Support data | Questions and messages you send us, and our replies | You |
| Business contact data | Name, company, work email and project details submitted through our business form | Business Customers |
Your voice recordings may reveal characteristics such as accent, approximate age and gender. We treat recordings as personal data and protect them accordingly. We do not use recordings to identify you or for biometric authentication.
Purposes and basis of processing
We process personal data on the basis of your consent, which you give when you register and when you accept the Contributor Agreement & Consent, and for certain legitimate uses permitted under Section 7 of the DPDP Act (for example, complying with law). We use personal data to:
- create and secure your account and log you in;
- show you Projects that match your dialects and enforce Project limits;
- check, review and approve Contributions, calculate your quality level and give you feedback;
- calculate earnings and pay you by UPI, issue statements and meet tax obligations;
- license Contributions with pseudonymous metadata to Business Customers for the development of speech and language technology;
- detect, prevent and investigate fraud, abuse and security incidents;
- provide support, send service notifications and respond to grievances;
- maintain consent and audit records and comply with legal obligations; and
- produce aggregated, non-identifying statistics (for example, total approved hours) for reporting.
We do not use your personal data for targeted advertising, and we do not sell personal data to advertisers or data brokers.
Automated processing
Some decisions are assisted by automated systems: uploads that are silent, too short, distorted or exact duplicates are refused automatically, and your quality level is calculated from your review history. Approval or rejection of each Contribution is made by a human Reviewer. You may ask us to re-check any decision through the support or grievance process.
Who we share data with
Business Customers
We share Approved Contributions with Business Customers together with pseudonymous metadata only: a random speaker ID that cannot be reversed to your account by the customer, age band (for example 25–34), gender, state, district, dialect, the prompt and any transcript. We never share your name, email address, mobile number, UPI ID, PAN, exact age or IP address with Business Customers. Our Data Licence Terms prohibit customers from attempting to re-identify contributors.
Service providers (Data Processors)
We use carefully selected providers who process data on our instructions under contract, including:
- Cloudflare, Inc. — website and app hosting, database, file storage, security and email delivery;
- email delivery providers (for example Resend), for login codes and service emails;
- banks and UPI payment service providers, to send your payments; and
- Google Fonts, which serves the fonts on our web pages (your browser sends your IP address to Google when loading them).
Legal and safety
We may disclose personal data where required by law, court order or a lawful request by a government authority, or where necessary to protect the rights, safety or property of LootBeez, our users or the public, including to prevent fraud.
Business transfers
If LootBeez is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, which will be bound by this policy or a policy offering equivalent protection. We will notify you of any such change.
International transfers
Our hosting providers operate global infrastructure, and some Business Customers are located outside India. Personal data and Contributions may therefore be processed outside India. We transfer data only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and we require recipients to protect it with appropriate safeguards.
How long we keep data
| Data | Retention |
|---|---|
| Account and profile data | While your account is active, and up to 12 months after closure for fraud prevention and dispute handling, unless erased earlier on your request where permitted |
| Payment, payout and tax records | Up to 8 years after the relevant financial year, as required by tax and accounting laws |
| Contributions not yet delivered | Until delivered to a customer, rejected and purged, or deleted at your request |
| Contributions delivered to customers | Held by the customer under its licence; we retain the pseudonymous metadata link and consent record for as long as the data may be in use, to demonstrate valid consent |
| Consent and audit records | As long as related data is in use, plus the limitation period for legal claims |
| Login codes | Valid for 10 minutes; records deleted periodically |
| Support messages | Up to 3 years |
| Business enquiry data | Up to 3 years from last contact |
How we protect data
- All connections to the Platform are encrypted with HTTPS/TLS.
- Recordings are stored in private storage and are accessible only through authenticated requests by you (your own recordings), assigned Reviewers and authorised administrators.
- Logins use one-time codes; sessions use signed, expiring tokens. Login codes are stored only as one-way hashes.
- Administrative actions, consent events and payouts are logged in an audit trail.
- Access is limited to people who need it for their role, and Reviewers are bound by confidentiality obligations.
- Data exported for customers is stripped of direct identifiers.
No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act and its rules.
Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process about you and the processing activities;
- Correction and completion of inaccurate or incomplete data — most profile details can be edited directly in the app;
- Erasure of personal data that is no longer necessary, subject to legal retention requirements;
- Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing done before withdrawal, and Contributions already delivered to customers cannot be recalled (they do not carry your identity);
- Nominate another person to exercise your rights in the event of your death or incapacity; and
- Grievance redressal by us, and thereafter by the Data Protection Board of India.
How to exercise your rights
Use Profile → “Delete my account & data” in the app, or write to privacy@lootbeez.shop from your registered email address. We may need to verify your identity. We respond within 30 days.
Your duties
As required by Section 15 of the DPDP Act, you must provide accurate information, must not impersonate anyone, must not suppress material information, and must not file false or frivolous complaints.
Children
The Platform is only for adults aged 18 and above. We do not knowingly collect personal data of children, and we do not collect recordings of children. If you believe a child is using the Platform, contact us and we will delete the account and its data.
Cookies and device storage
We do not use advertising or cross-site tracking cookies. We store a small amount of information on your device (such as your login session and language) to make the Platform work. See our Cookie & Storage Policy.
Changes to this policy
We will post any changes on this page with a new effective date. If changes materially affect how we use your data, we will notify you in the app or by email and, where required, ask for your consent again.
Contact and Grievance Officer
Privacy requests: privacy@lootbeez.shop
Grievance Officer: [GRIEVANCE OFFICER NAME] · grievance@lootbeez.shop
Postal address: LootBeezShop, [REGISTERED ADDRESS, CITY, STATE, PIN]
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India in accordance with the DPDP Act.