Privacy Policy

1) Scope: Website vs. Customer Platform Data

• Website/Marketing data (we control): Information collected when you browse the Website, submit forms, contact us, or otherwise communicate with us.
• Customer platform data (we process for customers): If you are a Lokta customer, your organization may upload or provide data into Lokta's platform (e.g., borrower/loan/transaction data). In most cases, your organization is the "Data Controller" and Lokta is a "Data Processor" acting on your instructions under a contract / DPA.
• AI assistant connector: If your organization uses Lokta and has turned on AI assistant access, section 13 explains what the connector reads, what we keep, and where its answers go.

2) Information We Collect

A. Information you provide

• Contact details: name, work email, phone number, company, title
• Communications: messages sent via forms, email, chat, or calls
• Preferences: marketing preferences, newsletter opt-ins

B. Information collected automatically

• Device and usage data: IP address, browser type, pages visited, timestamps, referring URLs
• Cookies and similar technologies (see Section 7)

C. Information from third parties

• Business contact data from partners, event organizers, or publicly available sources (e.g., LinkedIn) where permitted by law.

3) How We Use Information

We use information to:

• Provide and operate the Website and respond to your requests (e.g., demos, inquiries)
• Communicate about the Services, updates, and support
• Improve Website performance, security, and user experience
• Conduct analytics, audits, and internal reporting
• Comply with legal obligations and enforce our terms

4) Legal Bases (Where Applicable)

Depending on jurisdiction, we rely on:

• Consent (e.g., marketing emails, certain cookies)
• Legitimate interests (e.g., securing the Website, improving services, B2B communications)
• Contractual necessity (e.g., providing requested services)
• Legal obligation (e.g., compliance, lawful requests)

5) How We Share Information

We may share information with:

• Service providers that help operate our Website and business (e.g., hosting, analytics, CRM, email delivery, support tools) under confidentiality and security obligations
• Affiliates (if applicable) for internal operations
• Professional advisors (legal, auditors) where necessary
• AI assistant providers, such as Anthropic for Claude, when a Lokta customer's user asks that assistant a question through the Lokta connector (see section 13)
• Authorities when required by law or to protect rights, safety, and security
• Business transfers in connection with a merger, acquisition, or asset sale (with appropriate safeguards)

We do not sell personal information.

We use HubSpot to receive website form submissions and manage contact records. For a resource request, we send the email address and organisation you provide, the requested resource, source information and your consent choices to HubSpot. Requesting a resource does not subscribe you to future notes; that choice is separate.

6) Data Security

We use reasonable administrative, technical, and organizational safeguards to protect information from unauthorized access, loss, misuse, or alteration. No system is 100% secure, so we cannot guarantee absolute security.

7) Cookies & Similar Technologies

Nothing that measures or identifies you runs on this Website until you allow it. On a wider screen, such as a computer or most tablets, we ask on your first visit. On a narrower screen, such as a phone, we ask only on the resource pages where the question sits inside the page. Everywhere else on a phone, nothing runs unless you allow it from Cookie settings in the footer. Until you answer, no analytics or marketing script is loaded at all. If you close the question without answering, we ask again on a later visit. Your answer is kept in your browser's local storage so it is remembered, and a refusal is stored exactly like an acceptance, so we do not keep asking. You can change your mind at any time from Cookie settingsin the footer of every page.

The only thing stored before you choose is the record of the choice itself. Accepting turns on both groups described below, and rejecting turns on neither. Both are off until you accept.

Analytics

Google Analytics 4 (GA4). Aggregate usage: which pages are viewed, in what order, and where visitors arrive from. IP addresses are shortened before storage (anonymize_ip: true). This loads only if you allow Analytics.

Marketing

Google advertising. With Marketing allowed, GA4 also enables Google Signals, which supports remarketing (showing you our ads on other sites) and conversion measurement for our Google Ads campaigns.

Apollo website tracker. Identifies organisations visiting the site so we can follow up with businesses that show interest. It stores an anonymous visitor ID in your browser's local storage and sends page visits and referrer information to Apollo. It also loads LiveIntent, an identity resolution provider, which may return a hashed (MD5 and SHA-2) version of your email address; where it does, that hash is attached to the events sent to Apollo. A hashed email address is still personal data, which is why this sits behind Marketing consent and is off unless you turn it on.

Separately from the choice above, you can opt out of Google Analytics everywhere with the Google Analytics opt-out browser add-on, or block any of these scripts in your browser.

8) Data Retention

We retain information only as long as needed for the purposes described above, including to meet legal, accounting, or reporting requirements. Retention periods may vary based on the nature of the data and our obligations.

9) Your Choices & Rights

Depending on your location and applicable law, you may have rights to:

• Access, correct, update, or delete your information
• Withdraw consent (where processing is based on consent). For website tracking, use Cookie settings in the footer of any page. Withdrawing is no harder than granting was: the page reloads without the scripts, and the identifiers Apollo stored in your browser are deleted
• Opt out of marketing communications (use the unsubscribe link or email us)
• Request information about how your data is processed

If you are an end-customer of a Lokta client (e.g., a borrower), please contact the relevant organization directly, since they control the data and decisions.

10) International Transfers

If information is transferred across borders, we use appropriate safeguards as required by applicable law (e.g., contractual protections and security measures).

When a user asks an AI assistant a question through the Lokta connector, the answer goes to that assistant's provider, which may process it outside India.Section 13 explains how.

11) Children

The Website and Services are not intended for children. We do not knowingly collect personal information from children.

12) Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date will reflect changes. Material changes will be posted on the Website.

13) AI Assistant Connector

This section covers the Lokta MCP server (the "connector"). It lets authorized staff of a Lokta customer use an AI assistant, such as Claude, to read data held in their organization's Lokta platform.

A. Who decides

The customer decides whether the connector is turned on and which roles may use it. As section 1 explains, the customer is the Data Controller for its platform data, and Lokta acts as a Data Processor when the connector reads that data at a user's request. Under India's Digital Personal Data Protection Act, 2023, the customer is the Data Fiduciary for that data.

B. What the connector reads

When a signed-in user asks a question, the AI assistant calls the connector's tools. The connector returns only the data that user's Lokta role allows, such as loan balances and schedules, borrower records, collections queues, reports and audit entries. By default, borrower names are reduced to initials and mobile and identity numbers to their last four digits; the customer can turn this masking off. Each answer is limited to 50 rows. The connector cannot create, change or delete any record, and it refuses any request that contains an Aadhaar number.

C. What we keep

• Sign-in records: the lender code, username, time, network address and outcome of each sign-in, kept for 90 days to protect accounts and investigate misuse.
• Request records: for each request the connector makes, the time, the user, the kind of record requested, the outcome and the network address. They are stored in the customer's own Lokta platform with its other audit records, and kept for as long as the customer keeps those records. Search terms in them are stored masked.
• Account records: the sign-in service keeps one record per person, holding their username and lender code, with no password or email address. It is kept while the customer uses the connector, and removed when the customer asks.
• Service logs: the connector's own logs record failures only (which tool, which lender and the kind of error), never the contents of a request or an answer, and are kept for 30 days.
• Passwords: we do not store them. The customer's Lokta platform checks the password, and the sign-in service does not keep it.

Lokta does not receive the conversation between the user and the AI assistant, only the tool requests the assistant sends.

D. The AI assistant's provider

The data the connector returns goes to the provider of the AI assistant the user chose, such as Anthropic for Claude. That provider handles it under the customer's or the user's own terms with that provider, and may process it outside India. Lokta does not control how the provider handles it. Anthropic's privacy policy is at https://www.anthropic.com/legal/privacy. Customers should review those terms before turning the connector on.

E. Turning it off

The customer can turn the connector off for the whole organization at any time, and can end one user's access by disabling that user in Lokta. A user can also disconnect the connector in the AI assistant's settings.

F. Questions and security reports

Questions about the connector and reports of a security vulnerability go to support@lokta.ai. Put "Security" in the subject of a security report.

14) Contact Us

For privacy questions or requests, contact:

Lokta Fintech Private Limited (Lokta.ai)
Email: contact@lokta.ai