Your privacy matters. Clarity comes first.

Your trust matters to us. This policy explains how LumoHosting handles personal information when you browse our website, open an account, purchase hosting or other services, contact support, complete identity verification, or use our client portal.

It covers information we handle for our own customer relationships. If you host a website or application for your own users, you are responsible for your own privacy notices and processing choices. Our responsibilities for hosting that data depend on the services and agreements applicable to you.

Depending on the services you use, information may include:

• Account and contact details: name, email address, telephone number, account identifiers, billing address and business information.
• Order and billing records: purchased products, invoices, transaction references, taxes, account balances and wallet credit history.
• KYC information: identification and verification details required for account integrity, service eligibility and regulatory compliance.
• Technical information: IP addresses, device and browser information, access times, system events, support diagnostics and security logs.
• Communications: information you provide in enquiries, service tickets and complaint reports.
• Hosted content: data stored or processed through services you operate, subject to the service's technical and contractual model.

We do not ask for account passwords, payment PINs or one-time passcodes through ordinary support requests.

We use relevant information to set up and administer accounts, provision products, process billing, provide support, communicate service notices, investigate security incidents, prevent misuse, verify identity, maintain transaction records and comply with applicable law.

Where consent is required for optional communications, analytics or similar activities, we will provide the applicable choice or notice. We will not present optional marketing consent as mandatory for buying hosting when it is not necessary for that purchase.

LumoHosting requires identity verification for eligibility under its voluntary 7-day refund guarantee. Verification may also be necessary for fraud prevention, account security and particular regulated hosting services.

One lifetime voluntary refund per verified customer: we may use verified-identity and transaction records to identify repeat claims across multiple LumoHosting accounts. A shared home address, network, device or payment method alone does not prove that two accounts belong to the same person. Customers can request a review of an incorrect match.

Where KYC is incomplete, voluntary refund eligibility may remain on hold while the customer has a reasonable opportunity to complete verification. Mandatory legal remedies are not waived by this rule.

We use billing and payment information to confirm purchases, issue invoices, reconcile transactions, manage renewals, maintain accounts and investigate disputed charges. Payment processors may handle payment credentials according to their own privacy terms and the checkout method used.

Under LumoHosting's Refund & Cancellation Policy, approved voluntary refunds for eligible hosting purchases are credited to the customer's LumoHosting Wallet. Relevant records may include credited amounts, issue dates, purchases paid with wallet balance and prior voluntary refund eligibility.

Wallet credit records help us administer purchases and detect repeated or fraudulent refund claims. Legally required refunds remain governed by applicable law.

Customers may store website content, databases, emails and application information using LumoHosting services. Depending on the product, LumoHosting may have technical access necessary to maintain infrastructure, troubleshoot service issues, respond to authorized requests or address security threats.

Customers who collect personal data through their hosted websites or applications must provide appropriate notices, determine their lawful processing purposes, manage user permissions and maintain their own data protection practices. We recommend keeping independent backups and applying suitable access controls.

Hosted content may be processed or stored in locations associated with the selected product and its infrastructure. We should not promise India-only hosting or a particular data centre unless that placement is actually confirmed for the plan.

Information may be shared only as reasonably needed with contracted hosting and infrastructure providers, domain registries and registrars, payment processors, identity-verification providers, customer support or security vendors, and professional advisers. Specific third-party involvement depends on the services and vendors in use.

We may also disclose relevant information to competent authorities or other parties where required by law, valid legal process, or necessary for a legitimate security response. We do not describe customer-data sharing for advertising as a business practice unless it is actually implemented and disclosed.

Our site and client area may use cookies or comparable technologies for authentication, session security, user preferences, fraud prevention and website functionality. Optional analytics or advertising tools, if enabled, require appropriately accurate notices and choices.

Browser settings can help you manage cookies, but disabling essential cookies may affect signing in, billing or navigation. A detailed cookie inventory and any preference controls should reflect the actual scripts running on the live website.

We work to protect personal information using appropriate organizational and technical controls, including access restrictions, secure transmission where available, monitoring and incident response processes. No internet-connected service can promise absolute protection.

Security incident logging and notification obligations are governed by applicable law and the services involved. We review relevant incidents and provide legally required notices or cooperation when applicable.

We keep data only for purposes such as active account administration, service delivery, billing, anti-fraud review, disputes and applicable legal retention duties. Retention may differ by record category and product. Cancellation does not necessarily require immediate deletion of every lawful account or transaction record.

In particular, CERT-In directions prescribe a rolling 180-day ICT-log retention requirement for covered entities and five years of specified customer records after cancellation or withdrawal for covered data-centre, VPS, cloud and VPN providers. Applicability to LumoHosting's specific operations must be verified before committing to a blanket schedule.

Hosted website and database deletion procedures depend on the applicable service and operational retention rules. Customers should export their own data before terminating services.

You may contact us to request access to, correction of, updating of or deletion of personal information, or to raise a privacy concern, to the extent provided by applicable law. Some requests may require identity verification, and some records must remain available for legal compliance, disputes or security purposes.

India's Digital Personal Data Protection framework has phased commencement dates. We will apply the rights, notices and processes required by provisions in force at the relevant time, while preparing our practices for provisions that become effective later.

Use our Contact Us page and identify the request as a privacy matter. Do not include unnecessary identity documents in the first message.

Our hosting services are generally intended for individuals capable of entering into contracts or for authorized representatives of organizations. We do not intentionally design account registration for children.

If a minor's information is involved, we will handle it in accordance with the protections applicable at the relevant time and the nature of the service. Contact us if you believe information has been submitted without appropriate authorization.

Some technologies or third-party products, including global productivity services, domain infrastructure and payment services, may involve processing outside India. Data handling depends on the chosen product, service-provider contracts and laws applicable at the time.

We will not claim that all customer personal data remains within India unless that can be substantiated. Where transfer restrictions apply, we will observe them.

We may update this notice to reflect changes to products, systems, vendors, laws or customer processes. The latest version will be published here with an updated date. Where legally required, we will provide additional notice or obtain an appropriate choice before materially changing how personal information is used.

This page should be read with our Terms of Service, Acceptable Use Policy and Refund & Cancellation Policy.

For privacy questions, access or correction requests, or concerns about your account information, contact LumoHosting using our official contact channel.

LumoHosting · Block-E, Sushant Lok 2, Sector 56, Gurgaon, Haryana 122012, India.