Legal

Privacy Policy

How Lyca Technologies Private Limited collects, uses, and protects your information on the Lyca Technologies platform and related services. Effective Date: March 2026 · Version 1.0

Last updated: 1 March 2026

1. Introduction

Welcome to Lyca Technologies ("the Platform"). This Privacy Policy explains how Lyca Technologies Private Limited ("we", "us", or "our") collects, uses, stores, and protects information when you use our website, WhatsApp Business API, transactional Email API, and related software services (collectively, the "Service").

The Service is provided to businesses and organisations under a Software-as-a-Service (SaaS) or usage agreement. By accessing or using the Service, you agree to the practices described in this Privacy Policy.

This Service is not directed at children under the age of 13. All users of the Platform must be at least 13 years of age.

2. Who We Are

Lyca Technologies Private Limited is the provider of the Lyca Technologies Platform. When you send messages or emails through our APIs, you (or your organisation) act as the data controller for the content and recipient data you transmit. Lyca Technologies processes that data on your behalf to deliver the Service.

For questions about this Privacy Policy, contact us:

3. Information We Collect

We collect information necessary to provide and operate our communication services. This includes the following categories:

3.1 Account & Authentication Data

  • Full name and business / organisation name
  • Email address and phone number
  • Username and password (passwords are hashed using bcrypt)
  • API keys and authentication tokens
  • Billing and invoicing details
  • Profile information you choose to provide

3.2 Message & Delivery Data

  • Recipient phone numbers, email addresses, and message content you submit for delivery
  • Template content, media attachments, and related metadata required to route WhatsApp and email messages
  • Delivery status, timestamps, open/click events (where available), and bounce / failure reasons

3.3 Device & Push Notification Tokens

Where our dashboards or companion apps deliver push notifications, we may store:

  • Firebase Cloud Messaging (FCM) token — Android
  • Apple Push Notification service (APNs) token — iOS

These tokens are refreshed automatically and are used solely to route notifications to your device.

3.4 Notification Preferences

Users may configure preferred notification channels (email, WhatsApp, in-app, or push). These preferences are stored on our servers and honoured when dispatching service communications.

3.5 Activity & Log Data

  • Login timestamps and IP addresses
  • API request logs (for debugging, billing, and audit trails)
  • Device operating system, browser, and app version

4. How We Use Your Information

  • Authenticating users and managing secure access to accounts and APIs
  • Delivering WhatsApp messages and transactional emails you submit through the Platform
  • Sending service alerts, OTPs, billing notices, and support communications
  • Processing payments and preventing fraud or abuse
  • Maintaining audit logs and providing technical support
  • Improving platform features and fixing bugs
  • Complying with legal and regulatory obligations

We do NOT use your Customer Data for advertising, profiling, data brokering, or any commercial purpose outside the scope of your subscription.

5. Data Storage & Security

All data is stored on secure cloud infrastructure. We implement the following security measures:

  • Passwords are hashed using bcrypt before storage and are never stored in plaintext
  • All API communications are encrypted in transit using HTTPS/TLS
  • JWT or equivalent authentication with configurable expiry for session management
  • Role-based access control so users only access data pertinent to their account
  • Rate-limiting on sensitive operations such as password changes and OTP attempts

While we employ industry-standard security practices, no system is 100% immune to threats. In the event of a data breach that affects your personal data, we will notify affected customers and take all reasonable remediation steps.

6. Data Sharing & Disclosure

We do not sell, rent, trade, or otherwise transfer your personal information to third parties for commercial purposes. Data may be shared only in the following limited circumstances:

  • Platform providers: Meta / WhatsApp Business Platform to deliver WhatsApp messages; email infrastructure providers to deliver email
  • Service providers: cloud hosting, SMS/WhatsApp delivery partners, and payment processors who process data on our behalf under confidentiality obligations
  • Legal compliance: if required by law or a valid legal request (court order, governmental authority)
  • Business transfer: in the event of a merger, acquisition, or sale of assets, with prior notice to affected customers where required

Push notification services (Firebase/APNs) receive only device tokens and message payloads necessary to route the notification.

7. What We Do NOT Do

  • We do NOT display advertisements or serve ad content of any kind
  • We do NOT share or sell data to advertisers or marketing platforms
  • We do NOT use Customer Data for behavioural profiling sold to third parties
  • We do NOT collect location data (GPS) beyond what is incidental to IP logging for security
  • We do NOT use advertising pixels, cross-site trackers, or third-party ad cookies on the Service

8. Cookies & Tracking

Our website and dashboards may use essential session cookies to keep you logged in and remember preferences. We do not use advertising cookies. For full details, see our Cookie Policy.

9. Data Retention

Data is retained for the duration of your active subscription with Lyca Technologies. Upon termination of the agreement:

  • You may request a full export of your data prior to account closure
  • Data is deleted from our active systems within 30 days of account closure
  • Backup copies may be retained for up to 90 days for disaster recovery, after which they are permanently deleted

10. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

  • Right of access — request a copy of the data we hold about you
  • Right to rectification — request correction of inaccurate or incomplete data
  • Right to erasure — request deletion of your personal data (subject to legal retention requirements)
  • Right to restrict — request that we limit how we use your data
  • Right to portability — receive your data in a structured, machine-readable format
  • Right to object — object to specific uses of your data

To exercise these rights, contact us at support@lycatechnologies.com.

11. Age Requirements & Minors

The Platform is designed for businesses and professional users. It is not intended for and does not knowingly collect personal information from children under the age of 13. If we become aware that personal data has been collected from a child under 13 without appropriate consent, we will take prompt steps to delete that data.

12. Third-Party Services

To deliver the full functionality of the Platform, we integrate with the following categories of third-party services:

  • Cloud infrastructure providers (hosting and database storage)
  • Meta WhatsApp Business Platform (WhatsApp message delivery)
  • Firebase Cloud Messaging / Apple Push Notification service (push notification delivery, where applicable)
  • Email delivery infrastructure
  • WhatsApp Business API partners / SMS providers for OTP and messaging delivery where used

Each of these providers is bound by their own privacy policies and data processing agreements. We do not grant any third-party provider access to your data beyond what is strictly necessary for their integration to function.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

  • Update the 'Effective Date' at the top of this page
  • Notify account administrators via the platform or by email
  • Provide a reasonable notice period before significant changes take effect

Your continued use of the Platform after the effective date of the revised policy constitutes your acceptance of the changes.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Pakistan, without regard to conflict of law principles. Any disputes arising from this policy or the use of the Platform shall be subject to the exclusive jurisdiction of the courts of Karachi, Sindh, Pakistan.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please reach out:

© 2026 Lyca Technologies Private Limited. All rights reserved. · Effective Date: March 2026 · Version 1.0