Privacy Policy

Last updated 21 July 2026

This Privacy Policy explains how PranaAlpha Labs Private Limited ("Lokaah", "we", "us") collects, uses, shares, and protects personal data when you use lokaah.ai and the Lokaah API. We are the data controller for that personal data. By using the site or the API you agree to the practices described here.

Who we are

PranaAlpha Labs Private Limited, a company incorporated in India (CIN U62099KA2025PTC205507), based in Bengaluru, Karnataka, India. Our registered office address is on record with the Registrar of Companies and is available on request. For any privacy question, contact support@lokaah.ai.

Information we collect

  • Contact details you submit (name, work email, company, and what you are building) when you request access, book a demo, or email us.
  • Account and API data, once accounts are live: your OAuth identity, API credentials, and usage and request metadata; and billing details, which are handled by our payment provider and not stored by us in full.
  • Query content you send to the API, which we process to return resolved results.
  • Technical data: IP address, approximate location, and browser or device information, collected from server logs when you use the site or API.

How we use it

  • To provide, operate, secure, and improve the site and the API.
  • To respond to your requests, provision access, and support you.
  • To bill usage, once paid plans are live, and to prevent fraud and abuse.
  • To send you service messages and, where you have agreed or where the law allows for business contacts, occasional product updates.
  • To comply with our legal obligations and to establish, exercise, or defend legal claims.

Legal bases

For individuals in the EEA and UK, we process personal data under the GDPR on these bases: performance of a contract (to provide the service and respond to you); our legitimate interests (to secure and improve the service, prevent abuse, and reach business contacts about a product they may need), balanced against your rights; your consent (for non-essential cookies and, where required, marketing); and compliance with a legal obligation. Under India's Digital Personal Data Protection Act, 2023, we process personal data with your consent or for the legitimate uses that Act permits.

How we share it, and our sub-processors

We do not sell personal data. We share it only with service providers who help us run the service, under contracts that require them to protect it and use it only for us. Our current sub-processors are:

  • Vercel Inc. (United States): website hosting and content delivery.
  • Google LLC (United States and other regions): business email (support@ and sales@ lokaah.ai), the request-access form (Google Forms), and demo scheduling (Google Calendar).
  • Cloud infrastructure that runs the Lokaah API.
  • A payment processor, added here when paid plans launch.

We may also disclose personal data where the law requires it, or to protect our rights, users, or the security of the service.

How long we keep it

We keep personal data only as long as we need it for the purposes above or as the law requires. Our indicative periods are:

  • Waitlist and contact data: until you ask us to delete it, or up to 24 months after our last interaction, whichever is earlier.
  • Account and API usage data: for the life of your account and up to 12 months after it closes, for security and audit, then deleted or anonymized.
  • Query content and operational logs: kept only as long as needed to return your results and keep the service secure, then deleted or anonymized. We do not use your queries to train models: Lokaah is a knowledge layer beneath your agent, not a model provider.
  • Billing records: kept for the period Indian tax and company law require, typically up to eight years.

Security

We protect personal data with the measures described on our Security page, including encryption in transit, least-privilege access, and audit logging. No method of transmission or storage is completely secure, but we work to protect your data and to improve our safeguards over time.

International transfers

PranaAlpha Labs is established in India, and some of our sub-processors are outside your country. Where we process or transfer personal data of individuals in the EEA or UK outside those regions, we rely on the European Commission's Standard Contractual Clauses (2021) and, for UK data, the UK International Data Transfer Addendum, with any supplementary measures needed. Under the DPDP Act, we may transfer personal data outside India except to any country the Central Government restricts.

Your rights

Subject to applicable law, you may ask us to access, correct, complete, update, delete, port, or restrict your personal data, and you may object to processing or withdraw consent at any time. Under the DPDP Act, you may also raise a grievance and nominate another person to exercise your rights. To do any of these, email support@lokaah.ai and we will respond within the timelines the law sets. If you are not satisfied, you may complain to your data protection supervisory authority (in the EEA or UK) or, in India, to the Data Protection Board once it is operational. Our grievance contact is support@lokaah.ai.

Changes and contact

We may update this policy and will change the date above when we do. Questions or requests: support@lokaah.ai.