Privacy Policy

1. Who we are

LasChat is operated by LasMind Technologies, India. LasMind is the data fiduciary for account data described here. For messages and contact data that client businesses process through LasChat, the client business decides how that data is used and LasMind processes it on the client's behalf.

2. Data we collect

• Account details: name, email address, password (stored only as a secure hash) and, if you sign in with Google, your Google account identifier and profile picture.
• Business profile: business name, category, address, website and other details you enter during onboarding.
• WhatsApp number: the business phone number you connect to LasChat.
• Meta / WhatsApp Business data: WhatsApp Business Account and phone number identifiers, access tokens, message delivery status, and messages and contact details exchanged with your customers through the WhatsApp Cloud API.
• Message templates: template text, media and approval status you create or submit to Meta.
• Payment records: plan, amount, date, status and reference numbers of payments. We do not store full card or bank details.
• Logs: IP address, browser and device information, timestamps and security events (such as sign-ins and failed login attempts).

3. How we use data

We use this data to create and secure your account, provide and support the Service, connect and operate your WhatsApp Business number, manage billing, prevent fraud and abuse, comply with law, and communicate with you about the Service. We do not sell personal data.

4. Google user data

If you choose "Continue with Google", LasChat requests only the openid, email and profile scopes. We receive your Google account ID, email address, whether the email is verified, your name and profile picture.

• We use this data only to sign you in and to create or link your LasChat account (and, for admin sign-in, to confirm a verified @lasmind.com address).
• We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalised AI or machine-learning models.
• We do not share Google user data with third parties except the service providers who host and operate LasChat (Section 7), when required by law, or as part of a merger or acquisition with notice to you.
• We do not request access to Gmail, Google Drive, Contacts or any other Google service.

LasChat's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke LasChat's access at any time from your Google Account at myaccount.google.com/permissions. Revoking access stops future Google sign-in; to delete the data we already hold, see Section 8.

5. Cookies

LasChat uses only essential cookies needed for the Service to work:

• laschat_session: keeps you signed in (HTTP-only, secure).
• laschat_g_state, laschat_g_verifier, laschat_g_from: short-lived cookies that protect the Google sign-in flow (OAuth state and PKCE) and return you to the right page.
• laschat_setup_nudge: remembers whether you have dismissed the setup reminder.

Your light or dark theme choice is saved in your browser's local storage. LasChat does not currently use analytics or advertising cookies. If we add them, we will update this policy and ask for consent where required.

6. Storage, security and retention

Data is stored with our hosting and database providers using encryption in transit (HTTPS). Passwords are hashed, sessions expire automatically, and admin access is restricted and rate-limited. No method of transmission or storage is completely secure, but we take reasonable measures under Indian law to protect your data.

We keep account data while your account is active. After you close your account we delete or anonymise personal data within a reasonable period, except records we must keep for legal, tax, accounting or dispute purposes (such as payment records) and security logs kept for a limited time.

7. Service providers (sub-processors)

• Vercel: application hosting.
• A managed database provider: storage of account and business data.
• Meta Platforms (WhatsApp Cloud API): sending and receiving WhatsApp messages and templates.
• Google: Google sign-in.
• A payment gateway provider: processing payments, once paid plans launch.

Some providers may process data outside India, with safeguards as permitted under applicable law.

8. Your rights under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023 you may:

• access a summary of the personal data we process about you;
• correct, complete or update inaccurate data;
• request deletion of your data and account, and withdraw consent;
• nominate another person to exercise your rights; and
• raise a grievance with our Grievance Officer, and if unresolved, with the Data Protection Board of India.

To exercise these rights, email info@lasmind.com from your registered email address. If you are a customer of a business that uses LasChat, please contact that business first.

9. Children

LasChat is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy. We will change the "Last updated" date and, for significant changes, notify you by email or in the app. See also our Terms of Service.

11. Contact

• LasMind Technologies, India. Email: info@lasmind.com. Phone: +91 79999 88884
• Grievance Officer: Logeshwaran MA, Founder & CEO. Email: info@lasmind.com. Phone: +91 79999 88884