Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how LY (“Luminous & Young”, “we”, “our”, or “us”) collects, uses, stores, and handles personal data when you visit our public website at lyapp.in, communicate with us, submit career applications, or engage our product and technology services.

This policy applies to personal data collected through our online interfaces and direct communications. It is intended to provide clear, transparent information regarding our data practices. This policy does not replace specific terms established in signed commercial agreements or master service contracts.

2. About LY and Business Status

LY is an independent, remote-based technology startup operating from Lucknow, Uttar Pradesh, India. We serve domestic clients within India and international clients, primarily focusing on organizations in the United States and the United Kingdom.

LY operates through two functional branches:

• LY Product: Focused on proprietary SaaS applications, business tools, educational management platforms (such as LY Campus), and related software integrations.
• LY Projects: Focused on bespoke software engineering, website development, e-commerce and Shopify implementations, web applications, and technical project delivery.

Current Business Status: LY is an unregistered startup brand. It is not currently incorporated as a private limited company or other corporate entity under the Indian Companies Act. MSME/Udyam registration is planned but has not yet been completed. Contracts, proposals, and agreements specify the individual proprietor or authorized contracting person entering into the transaction.

3. Personal Information Collected

We collect personal information directly when you provide it to us through website forms, direct correspondence, or service interactions. Categories of data collected include:

• General Enquiries: Full name, email address, company or organization name, subject, and message details submitted through our contact form.
• Career Applications: Full name, email address, telephone number, current location (city and state/country), opportunity type sought, preferred department, experience level, educational background, voluntary portfolio/notes, and affirmative consent confirmation.
• Client Communications & Contracts: Contact information of client representatives, project specifications, commercial billing details, and communication history necessary to scope and deliver projects.
• SaaS Account Information: Where applicable to authenticated product platforms, user names, organizational email addresses, and access credentials.
• Technical Information: Standard network data transmitted during HTTP/HTTPS requests, such as client IP addresses, browser user-agent strings, and request timestamps recorded in server runtime logs.

4. How Information Is Collected

Information is collected through the following mechanisms:

• Direct entry by you into our contact and application forms.
• Direct email communications to our designated business addresses.
• Operational discussions, project scoping sessions, and contractual exchanges.
• Automated server-level request logging generated as a standard function of web infrastructure.

5. Purposes of Collection and Processing

We process personal information for reasonable, operational business purposes, including:

• Responding to business inquiries, service requests, and partnership proposals.
• Evaluating candidate applications and contacting applicants regarding potential employment or freelance opportunities.
• Delivering, configuring, and supporting software projects and agreed technical deliverables.
• Maintaining operational records, billing documentation, and commercial communication trails.
• Monitoring and protecting website stability, performance, and infrastructure security.
• Complying with applicable legal, accounting, and regulatory obligations.

6. Careers Applications and Recruitment Workflow

When you submit an application through our Careers portal, the submission is transmitted via an internal Next.js API route to a designated Google Sheet managed through a Google Apps Script Web App.

Third-Party Processing & Sharing Workflow: The Google Apps Script endpoint is configured to execute under our administrative account with public intake permissions (“Who has access: Anyone”) to allow applicants to submit their details without requiring a personal Google sign-in. The resulting spreadsheet (“Career Applications”) is stored within Google Drive and its access permissions are restricted to authorized LY team members evaluating candidate profiles.

Google LLC operates as an external cloud infrastructure and spreadsheet service provider processing your application data on our behalf. While Google maintains commercial enterprise security controls, transmission across the Internet and storage in external cloud services involves inherent risks. We do not claim or promise that Google Sheets, Google Apps Script, or any cloud environment is completely invulnerable, immune from security compromise, or entirely private. We do not sell or monetize applicant data.

7. SaaS Accounts and Product Information

For proprietary software products (such as LY Campus), institutional client data, student databases, and academic records are handled according to the actual product setup, deployment model, and the governing customer contract or subscription agreement. Where specified in the applicable agreement, institutional data remains the property and responsibility of the subscribing organization, with LY acting as a technology provider and technical data processor under that contract.

Where user account functionality is implemented in our software products, passwords are encrypted using bcrypt hashing prior to storage in the relevant application database. Subscribing organizations and administrative users remain responsible for administering authorized user access, safeguarding credentials, and enforcing appropriate role permissions within their institutional instances.

8. Project Enquiries and Client Information

Project specifications, requirements documents, and proprietary materials shared with LY Projects are treated as confidential business information.

Where client relationships require detailed confidentiality terms, a separate Non-Disclosure Agreement (NDA) or confidentiality clause within a Master Services Agreement (MSA) governs the handling, access limits, and return or destruction of proprietary client assets.

9. Third-Party Service Providers and Disclosures

We do not sell, rent, or trade personal information to third parties. We disclose data only to trusted service providers that support our operational infrastructure:

• Cloud & Hosting Infrastructure: Server runtimes and deployment platforms hosting our public web application.
• Google Workspace & Apps Script: Used for recording, managing, and organizing recruitment applications.
• Email Providers: Microsoft Outlook and Google Workspace for routing incoming and outgoing communications.
• Legal & Statutory Authorities: When strictly required by court order, applicable legal summons, or binding regulatory mandate under Indian law.

10. International Processing and Data Transfers

Because LY operates a remote team and provides services to international clients (primarily in the United States and the United Kingdom), data may be transmitted across state and national borders. Furthermore, our third-party infrastructure providers (such as Google and Vercel) maintain distributed server networks globally.

We take reasonable administrative measures to ensure service providers maintain appropriate security standards, but we do not represent that formal international cross-border transfer certifications (such as EU Standard Contractual Clauses or Data Privacy Framework registrations) are currently executed.

11. Security Safeguards

We implement reasonable administrative and technical safeguards designed to protect personal data, limited to the measures actually implemented in our workflows:

• Transport Encryption: All public website pages and internal submission API routes are served over standard HTTPS (TLS encryption) provided by our web hosting infrastructure.
• Credential Protection: For software products incorporating authenticated user accounts (such as LY Campus backend systems), user passwords are cryptographically hashed using bcrypt. Note that the public marketing website does not create or store user passwords.
• Spreadsheet Formula Sanitization: Form submission data handled by our Google Apps Script is sanitized prior to writing to Google Sheets by prepending a single apostrophe to inputs beginning with formula characters (=, +, -, @, |), preventing spreadsheet formula execution.
• Access Limitations: Access to recruitment spreadsheets and administrative mailboxes is intended only for authorized team members with an operational necessity, governed by Google and Microsoft account credentials.

Important Limitation: We do not claim full-disk encryption at rest across all endpoints, automated intrusion detection, or zero-trust network segregation unless specifically audited and verified. No Internet-connected software system or external cloud service is completely secure, and we cannot guarantee absolute security.

12. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary to satisfy the purpose for which it was collected, fulfill contractual obligations, maintain operational business records, or comply with statutory requirements.

• Career application details are retained for a reasonable evaluation period to consider candidates for active or upcoming opportunities.
• Client project communications and transaction records are retained during the project lifecycle and for an appropriate post-delivery recordkeeping period.
• General inquiry emails are periodically reviewed and cleared when no ongoing business matter remains.

We do not guarantee automated periodic deletion schedules, and retention periods may vary based on operational necessity and legal requirements.

13. User Requests and Withdrawal of Consent

Subject to applicable law, you may contact us to review, update, or correct personal data you have submitted to us, or request that your details be removed from our active recruitment records. You may also withdraw consent previously provided for application processing.

Requests will be reviewed in good faith and actioned within a reasonable timeframe, subject to our operational ability and any legal or contractual record-retention requirements. We do not promise immediate or unconditional deletion where retention is required by law or necessary for dispute defense.

14. Cookies and Local Storage

Our public website does not employ invasive third-party advertising cookies or cross-site tracking beacons.

We use browser localStorage solely for functional preferences (specifically, storing your light or dark theme toggle selection under the key ly-theme). Standard, temporary session state may be utilized within authenticated SaaS product sessions.

15. Children's Information

Our website, products, and services are directed at business professionals, adult clients, educational institutions, and job applicants. We do not knowingly solicit or collect personal data directly from children under 18 years of age without parental or verified institutional authority.

If you believe a minor has submitted personal information to us without appropriate authorization, please notify us so we can investigate and remove the information.

16. Third-Party Websites and External Links

Our website may contain links to external websites, platforms, or services (such as LinkedIn, GitHub, or partner tools). We do not control and are not responsible for the privacy practices, content, or data protection policies of third-party websites. We encourage you to review their policies independently.

17. Statutory Context & Legal Standards

This policy is drafted in the context of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), which were officially notified by the Ministry of Electronics and Information Technology (MeitY) in November 2025 with phased commencement schedules. We do not state that all provisions of the statutory framework are currently operationalized, nor does the existence or publication of this website privacy policy establish certified legal compliance or immunity from regulatory inquiry.

We do not claim formal registration, certification, or verified compliance with foreign privacy regimes such as the European Union General Data Protection Regulation (GDPR) or UK GDPR. International users interact with our platforms with the understanding that their data is processed according to the operational practices described in this policy and any applicable signed customer agreements.

18. Policy Updates

We may update this Privacy Policy periodically to reflect enhancements in our services, modifications to our data infrastructure, or updates to applicable statutory requirements. Any revisions will be published on this page with an updated “Last updated” timestamp. Continued use of our website or services after changes are posted constitutes acknowledgment of the updated policy.