Privacy Policy

This Privacy Policy explains how Lacspace Corporation Pvt. Ltd. handles personal data in connection with Lekhio (the “Service”), our marketing website and related services. It applies to visitors of our website, individuals who register for an Account, and Users who access the Service on behalf of an organization.

The Service is a business ERP: much of the data you enter (contacts, invoices, purchase orders, inventory, finance records) relates to your own customers and operations. This policy describes what we do with data for which we act as controller. Where we process personal data on your behalf as a processor, the “Data of your customers” section and your agreement with us govern.

Lekhio is a product of Lacspace Corporation Pvt. Ltd., a company registered in India and Nepal. For personal data we collect as a controller,Lacspace is the data controller. Our head offices are:

• Kathmandu, Nepal — Bhimsengola, Old Baneshwor, Kathmandu, Bagmati, Nepal.
• Nagpur, India — Nagpur, Maharashtra, India.

For any privacy question, you can contact us at compliance@lacspace.com.

Account information

When you register, we collect your name, email address, organization name, role, and authentication data such as passwords (stored only as salted hashes) or email one-time codes.

Business and CRM data you enter

You and your Users submit business records into the Service, which may include contact details of your customers and suppliers, invoices, purchase orders, product and inventory data, and financial records. This content is Customer Data that you control.

Usage and log data

We automatically collect technical data when you use the Service, such as IP address, device and browser type, pages viewed, actions taken, timestamps, and diagnostic logs. We use this to operate, secure and improve the Service.

Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy.

Payment metadata

When you purchase a paid plan, payments are handled by our payment providers. We receive payment metadata such as plan, amount, currency, billing contact and transaction status. We do not store full card numbers; card details are handled directly by our PCI-compliant payment processors.

We use personal data to:

• Provide, operate, maintain and secure the Service and your Account.
• Authenticate Users, prevent fraud and abuse, and enforce our Terms.
• Process Subscriptions, payments and invoices.
• Provide customer support and respond to your requests.
• Send service communications, security alerts and, where permitted, product updates you can opt out of.
• Analyze aggregate usage to understand and improve the Service.
• Comply with legal obligations and protect our rights and those of our users.

Where data-protection laws such as the EU/UK GDPR apply, we rely on the following legal bases:

• Contract — to provide the Service you have signed up for and to manage billing.
• Legitimate interests — to secure, maintain and improve the Service, prevent abuse, and grow our business, balanced against your rights.
• Consent — for optional cookies and certain marketing, which you can withdraw at any time.
• Legal obligation — to comply with applicable laws in India, Nepal and other jurisdictions.

We use strictly necessary cookies for authentication and security, preference cookies to remember settings such as light/dark theme and language, and privacy-friendly analytics to understand aggregate usage. We avoid third-party advertising cookies. For full details and your choices, see our Cookie Policy.

We do not sell your personal data. We share personal data only in the limited circumstances below:

• Subprocessors and service providers — vetted vendors who perform services on our behalf, such as cloud hosting and infrastructure, email delivery, error monitoring and analytics, under contractual confidentiality and data-protection obligations.
• Hosting and cloud providers — that store and process data to run the Service.
• Payment providers — to process Subscription payments.
• Legal and safety — where required by law, court order or a lawful request, or to protect the rights, property or safety of Lacspace, our users or the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.

We retain personal data for as long as your Account is active and as needed to provide the Service. After termination, we retain Customer Data for a limited period to allow export and to meet legal, tax and accounting obligations, after which it is deleted or anonymized. Backups are cycled on a rolling schedule. You can request deletion as described in Your Rights.

Lacspace operates in Nepal and India and serves customers in South Asia and beyond. Personal data may be processed in, or transferred to, Nepal, India and other regions where we or our subprocessors operate. These regions may have different data-protection laws than your own.

Where such transfers occur, we take steps to ensure an appropriate level of protection, including contractual safeguards with our subprocessors and, where required, recognized transfer mechanisms.

We implement technical and organizational measures designed to protect personal data, including:

• Encryption in transit using TLS/HTTPS for connections to the Service.
• Token-based authentication using signed JWTs and secure session handling.
• Multi-tenant isolation so each organization’s data is separated and scoped to its Tenant.
• Role-based access control (RBAC) and least-privilege access controls for Users and staff.
• Monitoring, logging and regular review of access to systems and data.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you as required by applicable law.

Subject to applicable law, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where we rely on it.

To exercise these rights, email compliance@lacspace.com or use the tools available in your Account. We will respond within the timeframe required by law. If you are a User whose data was entered by an organization, please contact that organization, which controls the data; we will assist them as their processor. You may also have the right to lodge a complaint with your local data-protection authority.

The Service is a business tool intended for organizations and is not directed at children. We do not knowingly collect personal data from individuals under 16 years of age (or under 18 where a higher age applies under local law). If you believe a minor has provided us personal data, please contact us and we will take appropriate steps to delete it.

When you use the Service to store data about your own customers, suppliers and contacts, you are the data controller for that Customer Data and Lacspace acts as a data processor, processing it on your instructions to provide the Service.

You are responsible for providing appropriate privacy notices to, and obtaining any required consents from, the individuals whose data you enter, and for handling their rights requests. We make reasonable efforts to assist you as your processor. Our processing of Customer Data is governed by our Terms and any applicable data processing terms.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

To contact us about privacy or to exercise your rights:

• Privacy & compliance: compliance@lacspace.com
• Support: support@lacspace.com
• Lacspace Corporation Pvt. Ltd. — https://lacspace.com

You can also reach us through our contact page.