Privacy Policy

1. Who we are

Lumo Rentals Private Limited ("Lumo", "we") runs the Lumo app and www.lumo.rentals, a marketplace where people rent things from people near them. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Lumo is the data fiduciary for the personal data described here.

Registered and principal place of business: First Floor, Khata No 235, Site No 13, Varthur Main Road, Munnekolala, Bengaluru Urban, Karnataka 560037. CIN U77100KA2025PTC199038 · GSTIN 29AAGCL1771N1ZY.

This policy applies to renters, hosts (individuals and businesses), members of business teams, and visitors to our website. Delivery partners (riders) get a separate notice with their partner agreement.

2. What we collect

You give us:

• Account: name, mobile number, email (if added), profile photo, city, language.
• Identity (individuals): Aadhaar number, PAN, whether the two are linked, the name and date of birth those checks return, and a live selfie (while the selfie check is switched on). We do not collect Aadhaar biometrics.
• Identity (businesses): company PAN, GSTIN, the legal and trade name these return, the business's display name, and the founder's and team members' phone numbers and roles.
• Bank and payout details: bank account number, IFSC, the account holder name returned by the bank check, a UPI ID if you choose one, and your payout choice (bank, UPI or Lumo Wallet).
• Listings: item title, description, photos, condition, price, deposit, availability, pickup point and pickup windows, and delivery options.
• Bookings: dates, pickup or delivery addresses, handover codes, handover and return photos and notes, extensions, cancellations, damage claims and their evidence.
• Messages and reviews: what you write to other users, to Lumo support and to Lumo's chat or voice assistant, and the ratings and reviews you give.
• Payments: amounts, status, refunds, wallet credits, coupons, and the order and payment references from Cashfree Payments. Card numbers, CVV, UPI PIN and banking passwords are entered on Cashfree's screens. Lumo never sees or stores them.

Collected automatically:

• Location: your device location, only if you allow it, to show listings near you and to work out pickup and delivery. You can turn it off in your phone's settings.
• Delivery tracking: when a delivery partner carries an item, the partner's live location during that trip.
• Device and usage: device model, operating system, app version, IP address, crash reports, and the screens, searches, listings viewed or saved, checkouts and notification taps (see section 7).

From others:

• Verification partners (SurePass, Cashfree): the results of identity, PAN, GSTIN and bank checks.
• Delivery partners: pickup and delivery status, proof of delivery.
• Other users: reviews about you, messages, and damage reports with photos.

3. Why we use it

Purpose	Data used	Legal basis (DPDP Act)
Run your account, listings and bookings, handovers, returns and deliveries	Account, listings, bookings, addresses, location, messages	Your consent, given when you sign up and book
Verify that renters, hosts and businesses are who they say they are, and prevent fraud and fake accounts	Identity, bank, business data, selfie	Your consent on the "Before you verify" screen
Take payments, refunds and deposits, and pay hosts	Payments, bank and payout details	Consent; legal duties (tax, accounting)
Resolve damage and deposit disputes	Handover and return photos, messages, identity	Consent; legitimate use to protect users
Keep Lumo safe: screen listings, stop banned items, act on complaints	Listings, photos, reports	Consent; legal duties under the IT Rules, 2021
Service messages (push, WhatsApp, SMS, email)	Contact details, bookings	Consent
Personalisation, reminders and offers	Usage data	Consent, which you can withdraw (section 7)
Meet legal duties and answer lawful requests	As required	Legal obligation (DPDP Act s.7)

Automated decisions: AI models screen listing photos, suggest categories and prices, and power Lumo's chat and voice assistant. Automated systems choose which reminders and offers you get. Anything with a money effect above set limits is checked by a person, and you can ask for a person to review any automated decision.

4. Who can see what

Other users

• Before a booking: a listing shows the host's first name (or the business name), photos, price, deposit and the area the item is in, never the exact address. The host sees nothing about a renter until a booking is paid.
• After a booking is paid: the renter and the host see each other's name, the pickup point and any delivery address, and can contact each other through the app. A booked renter may see the host's pickup point.
• Business hosts: renters see only the business name. Team members see the business's bookings according to their role.
• Reviews you write are public on Lumo, shown with your first name and last initial.

Delivery partners (Borzo, and Lumo's own delivery partners where available)

• Before a partner accepts a trip, they see only the approximate area.
• After they accept: the pickup and drop addresses, and a contact name and number for each end. During the trip, the renter and host see the partner's name and live location.

Service providers (processors) acting for us

Provider	What for
SurePass	Aadhaar number, PAN, the Aadhaar–PAN link and live-selfie checks
Cashfree Payments	Payments, refunds, host payouts, bank checks (₹1 deposit), GSTIN and company PAN checks, Aadhaar DigiLocker account check
Amazon Web Services (Mumbai, India)	Hosting, databases and file storage
Modal	Runs Lumo's AI agents (the support concierge and internal operations agents)
Google Gemini	AI screening of listing photos and damage photos, the WhatsApp and chat concierge, and Lumo's voice assistant
OpenAI, Anthropic	AI models used by Lumo's chat assistant and internal operations agents
Google Firebase	Push notifications, crash reports, app analytics and remote settings; website analytics after you accept the consent banner
Google Maps Platform	Maps, place search, and routes for deliveries
Airtel	SMS one-time passwords for sign-in
Meta	WhatsApp Business (sign-in codes, booking messages, support chat), the Facebook SDK in our apps, and the Meta Pixel on our website (see section 7)
Google (Gmail / Workspace)	Sending email
Exotel	Masked phone calls between renters, hosts and delivery partners, and calls with Lumo's voice assistant
Borzo	Deliveries you choose (Lumo's own delivery partners are covered in section 4)
Mixpanel	App usage analytics
Microsoft Clarity	App and website usage analytics (typed text is masked)
Google Analytics 4, Google Ads	Website analytics and ad measurement, only after you accept the consent banner
Slack	Internal alerts to Lumo staff about bookings, payouts and deliveries, which may include booking details

Processors may use your data only to provide their service to Lumo.

Others

• Government, courts, police and regulators, when the law requires or to protect someone's safety. If a renter does not return an item, we may give the renter's verified details to the police and the host.
• A buyer or successor, if Lumo is merged or sold. We will tell you before your data comes under a different privacy policy.

We do not sell your personal data.

5. Where it is stored

Lumo's databases and files are stored in India (AWS Mumbai). Some providers above (for example Google, Meta, Mixpanel, Microsoft, OpenAI, Anthropic, Modal and Slack) may process data outside India. We use them only where the DPDP Act permits such transfers. We will not transfer personal data to any country the Government of India has restricted under section 16 of the DPDP Act.

6. How long we keep it

Data	How long
Account and profile	While your account is open. Erased 30 days after you delete your account. The 30 days let us settle any open booking, refund or payout.
Identity proofs: Aadhaar, PAN, check results, selfie, bank details, company PAN, GSTIN	Stored encrypted. Only authorised Lumo staff can open them, only to resolve a dispute or meet a legal duty, and every view is logged. Kept for the life of the account and 180 days after it closes, then deleted.
Booking, payment, refund and payout records	For as long as Indian tax and accounting laws require (currently 8 years from the end of the financial year). After account deletion they carry no name, phone or email.
Handover and return photos, booking messages	180 days after the booking ends, or until any dispute about it is resolved if that is later. Then deleted or anonymised.
Delivery partners' live location during a trip	30 days after the trip.
Usage data and the profile built from it	Up to 24 months from your last activity, or until you withdraw consent.
Listings	Until you remove them or delete your account.

7. Analytics, ads and your choices

• What we record in the app: screens opened, searches and filters, listings viewed or saved, checkouts started or left, bookings, notification taps, device type, app version, and summaries of your chats with Lumo's assistant, so the next chat can continue.
• Tools in our apps: Google Firebase (analytics, crashes, notifications), Mixpanel, Microsoft Clarity (screen recordings with typed text masked), Google Maps, Cashfree's payment screens, and the Meta (Facebook) SDK. Meta receives app events (for example items viewed, searches, checkouts and bookings with amounts). On iPhone your advertising ID and Lumo user ID go to Meta only if you allow tracking. On Android your Lumo user ID is attached. We never send these tools your name, phone number, email or documents. Where an ID is needed, it is a random Lumo user ID.
• Website: www.lumo.rentals uses browser storage for sign-in, preferences and your consent choice. It shows a consent banner. Only if you accept does it load Google Analytics 4, the Google Ads conversion tag, the Meta Pixel, Microsoft Clarity and Firebase Analytics. If you decline, none of these load, and Lumo keeps only anonymous visit counts in its own systems, without your user ID. You can change your choice later in your profile.
• Your choices: Profile › Personalisation & analytics turns off analytics beyond what bookings need, and turns off personalised offers. Profile › Notifications turns off marketing. On iPhone, Settings › Privacy & Security › Tracking. On Android, reset or delete your advertising ID. Service messages about your bookings continue.

8. Your rights

Under the DPDP Act you can:

• get a summary of your personal data, how we use it, and who we shared it with;
• have wrong or incomplete data corrected, completed or updated;
• have your data erased (delete your account in the app, or email us). Data that the law makes us keep is erased when that period ends;
• withdraw consent at any time. This is as easy as giving it, and does not affect what was done before. Some services (for example booking) need certain data, so withdrawing it may mean you can't use them;
• nominate someone to exercise your rights if you die or are unable to;
• complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

To use a right, use the in-app option or write to the Grievance Officer. We may ask you to confirm it's you. We respond within 30 days, and in any case within the time the DPDP Rules allow.

9. Security

Data is encrypted in transit. Identity proofs and bank numbers are also encrypted at rest. Only staff who need access have it, and access to identity proofs is logged. Payments run on Cashfree, a PCI DSS compliant gateway. No system is completely secure. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

10. Children

Lumo is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, tell the Grievance Officer and we will delete it.

11. Changes

We will post changes here with a new effective date, and tell you in the app before a material change takes effect. For a material change, we ask you to accept the new version at your next sign-in or next checkout, whichever comes first, and record which version you accepted. If a change needs new consent (for example a new purpose), we will ask for it.

12. Grievance Officer and contact

• Grievance Officer: Zahid Shaik, Grievance Officer
• Email: support@lumo.rentals
• Address: First Floor, Khata No 235, Site No 13, Varthur Main Road, Munnekolala, Bengaluru Urban, Karnataka 560037
• Customer care: 040-491-70880 · WhatsApp 90352 45864

We acknowledge a grievance within 24 hours and aim to resolve it within 15 days, or sooner if the law requires.

13. Vehicle rentals (legacy)

While Lumo still offers vehicle rentals, a vehicle booking also involves the renter's driving licence, the host's vehicle registration (RC) and insurance documents, and odometer and vehicle photos at the start and end of a trip. These are used to check eligibility and to resolve disputes, and are kept on the same terms as identity proofs (section 6). This section will be removed once vehicle rentals stop.