Privacy Policy

1) Scope: Website vs. Customer Platform Data

• Website/Marketing data (we control): Information collected when you browse the Website, submit forms, contact us, or otherwise communicate with us.
• Customer platform data (we process for customers): If you are a Lokta customer, your organization may upload or provide data into Lokta's platform (e.g., borrower/loan/transaction data). In most cases, your organization is the "Data Controller" and Lokta is a "Data Processor" acting on your instructions under a contract / DPA.

2) Information We Collect

A. Information you provide

• Contact details: name, work email, phone number, company, title
• Communications: messages sent via forms, email, chat, or calls
• Preferences: marketing preferences, newsletter opt-ins

B. Information collected automatically

• Device and usage data: IP address, browser type, pages visited, timestamps, referring URLs
• Cookies and similar technologies (see Section 7)

C. Information from third parties

• Business contact data from partners, event organizers, or publicly available sources (e.g., LinkedIn) where permitted by law.

3) How We Use Information

We use information to:

• Provide and operate the Website and respond to your requests (e.g., demos, inquiries)
• Communicate about the Services, updates, and support
• Improve Website performance, security, and user experience
• Conduct analytics, audits, and internal reporting
• Comply with legal obligations and enforce our terms

4) Legal Bases (Where Applicable)

Depending on jurisdiction, we rely on:

• Consent (e.g., marketing emails, certain cookies)
• Legitimate interests (e.g., securing the Website, improving services, B2B communications)
• Contractual necessity (e.g., providing requested services)
• Legal obligation (e.g., compliance, lawful requests)

5) How We Share Information

We may share information with:

• Service providers that help operate our Website and business (e.g., hosting, analytics, CRM, email delivery, support tools) under confidentiality and security obligations
• Affiliates (if applicable) for internal operations
• Professional advisors (legal, auditors) where necessary
• Authorities when required by law or to protect rights, safety, and security
• Business transfers in connection with a merger, acquisition, or asset sale (with appropriate safeguards)

We do not sell personal information.

6) Data Security

We use reasonable administrative, technical, and organizational safeguards to protect information from unauthorized access, loss, misuse, or alteration. No system is 100% secure, so we cannot guarantee absolute security.

7) Cookies & Similar Technologies

Nothing that measures or identifies you runs on this Website until you allow it. On your first visit we ask, and until you answer, no analytics or marketing script is loaded at all. Your answer is kept in your browser's local storage so it is remembered, and a refusal is stored exactly like an acceptance, so we do not keep asking. You can change your mind at any time from Cookie settings in the footer of every page.

The only thing stored before you choose is the record of the choice itself. Accepting turns on both groups described below, and rejecting turns on neither. Both are off until you accept.

Analytics

Google Analytics 4 (GA4). Aggregate usage: which pages are viewed, in what order, and where visitors arrive from. IP addresses are shortened before storage (anonymize_ip: true). This loads only if you allow Analytics.

Marketing

Google advertising. With Marketing allowed, GA4 also enables Google Signals, which supports remarketing (showing you our ads on other sites) and conversion measurement for our Google Ads campaigns.

Apollo website tracker. Identifies organisations visiting the site so we can follow up with businesses that show interest. It stores an anonymous visitor ID in your browser's local storage and sends page visits and referrer information to Apollo. It also loads LiveIntent, an identity resolution provider, which may return a hashed (MD5 and SHA-2) version of your email address; where it does, that hash is attached to the events sent to Apollo. A hashed email address is still personal data, which is why this sits behind Marketing consent and is off unless you turn it on.

Separately from the choice above, you can opt out of Google Analytics everywhere with the Google Analytics opt-out browser add-on, or block any of these scripts in your browser.

8) Data Retention

We retain information only as long as needed for the purposes described above, including to meet legal, accounting, or reporting requirements. Retention periods may vary based on the nature of the data and our obligations.

9) Your Choices & Rights

Depending on your location and applicable law, you may have rights to:

• Access, correct, update, or delete your information
• Withdraw consent (where processing is based on consent). For website tracking, use Cookie settings in the footer of any page. Withdrawing is no harder than granting was: the page reloads without the scripts, and the identifiers Apollo stored in your browser are deleted
• Opt out of marketing communications (use the unsubscribe link or email us)
• Request information about how your data is processed

If you are an end-customer of a Lokta client (e.g., a borrower), please contact the relevant organization directly, since they control the data and decisions.

10) International Transfers

If information is transferred across borders, we use appropriate safeguards as required by applicable law (e.g., contractual protections and security measures).

11) Children

The Website and Services are not intended for children. We do not knowingly collect personal information from children.

12) Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date will reflect changes. Material changes will be posted on the Website.

13) Contact Us

For privacy questions or requests, contact:

Lokta.ai
Email: contact@lokta.ai