Privacy Policy

1. Introduction

Lotus365 is operated by Lotus365 AI Books Ltd, located at 27/3, W-1, Opposite Mother Dairy, DESU Road, Mehrauli, New Delhi 110030, India (“Lotus365,” “we,” “us,” or “our”).

This Privacy Policy explains how we handle personal information when you visit lotus365.network, use our AI bookkeeping software, create an account, or contact us.

We are responsible for information used for our own account administration, billing, and support. Where we process records on behalf of a business customer, the customer's instructions and any applicable data-processing agreement govern that processing. The customer remains responsible for having lawful authority to supply those records.

This policy applies to Lotus365. Independently operated websites and services have their own privacy notices.

2. Information We Collect

Information you provide

Information	Examples	Purpose
Account and business details	Name, email address, business name, and account preferences	Create and manage accounts and communicate with you
Bookkeeping records	Spreadsheets, receipt and bill images, transaction details, and related documents	Extract and organise accounting information
Billing information	Billing contact details, subscription status, invoices, and payment references	Manage subscriptions, payments, and refunds
Support communications	Messages, attachments, and information supplied with an enquiry	Answer questions and resolve problems

Uploaded records may contain information about customers, employees, suppliers, or clients. We receive that information from the person or business submitting the records. Only upload information you are lawfully entitled to provide.

Technical and usage information

We collect technical information needed to operate and secure the Service, such as IP addresses, browser and device details, access logs, and error information.

Additional analytics or tracking: [Identify any usage analytics collected, the tools used, and their purposes, or state that no optional analytics are used.]

Cookies and similar technologies are addressed in Section 10.

Children

The Service is intended for adults and is not directed at people under 18. If you believe a child has created an account, contact us so we can investigate and take appropriate action.

3. How We Use Information

We use information to:

• Provide access to Lotus365 and process submitted bookkeeping records.
• Manage accounts, subscriptions, payments, and refunds.
• Respond to enquiries and provide support.
• Maintain service reliability, investigate errors, and prevent misuse.
• Send account, billing, security, and service notices.
• Meet applicable legal obligations and address disputes.

Where we send promotional communications, we do so in accordance with applicable law. You can unsubscribe from marketing messages without opting out of essential account communications.

Legal grounds for processing

Processing purpose	Legal basis
Creating individual accounts, providing requested services, and managing subscriptions	Contract, where the processing is necessary to deliver the service requested by that individual
Keeping legally required billing and tax records and making required disclosures	Compliance with applicable legal obligations
Managing business contacts, security, fraud prevention, troubleshooting, and service administration	Legitimate interests in managing business relationships and operating a reliable and secure service, where permitted and balanced against your rights
Optional activities requiring consent	Your consent, which you may withdraw

Any additional purposes or legal bases: [Describe any other actual processing, including handling of special-category information where relevant.]

If information is necessary to provide a requested feature and you do not supply it, we may be unable to provide that feature.

4. Storage, International Transfers, and Security

Storage and processing locations

Locations: [Identify the countries or regions used for hosting, backups, support access, and AI or document processing.]

Any offered data-residency choices and their limits will be disclosed when available. A storage location does not necessarily determine where every service provider processes information.

Where personal information is transferred internationally, we use the safeguards required by applicable law.

Transfer arrangements: [Identify the applicable adequacy decision, contractual safeguards, or other permitted transfer mechanism, and how users can obtain further information.]

Security

We apply technical and organisational measures appropriate to the information processed and the associated risks.

Implemented safeguards: [Insert verified security measures, such as encryption, access restrictions, authentication controls, or monitoring.]

No system can guarantee absolute security. You should protect your credentials and manage permissions for people who use your account.

Security incidents

If a personal-data breach occurs, we assess its impact and take appropriate response measures. We notify relevant authorities and affected individuals where legally required, within the deadlines that apply to the incident.

5. Sharing and Disclosure

We may disclose information:

• To service providers: For hosting, document processing, payments, support, and other functions needed to deliver the Service.
• At your direction: When you authorise access or an available integration.
• For legal obligations: To comply with valid legal requirements or requests.
• For security and legal claims: Where necessary and lawful to investigate misuse, protect rights, or establish or defend claims.
• During a business transfer: In connection with a merger, acquisition, or similar transaction, subject to appropriate confidentiality and applicable law.

Service providers processing information on our behalf are subject to appropriate contractual restrictions.

We do not sell personal or financial information. We do not publish customer financial records without authorisation or another lawful basis.

6. Your Privacy Rights

Depending on your location, the information involved, and our legal basis, you may have rights to:

• Obtain access to your personal information.
• Correct inaccurate or incomplete information.
• Request deletion.
• Restrict certain processing.
• Receive a portable copy of eligible information.
• Withdraw consent where processing relies on consent.

Objections: Where applicable, you may object to processing based on legitimate interests. You can also object to direct marketing through the unsubscribe option or by contacting us.

Contact [email protected] to exercise your rights. We may need reasonable information to verify your identity and will respond within the applicable legal timeframe.

Where records are processed on behalf of a business customer, we may refer your request to that customer and assist as required by law.

You may raise a privacy concern with us or complain to the competent data-protection authority, subject to applicable procedures.

Relevant regulator and contact details: [Insert the applicable authority and complaint link; include the UK ICO (ico.org.uk) where applicable.]

7. Retention and Deletion

We retain information only for as long as needed for its stated purpose, contractual commitments, or applicable legal requirements. We consider account status, the nature of the records, security needs, and any unresolved claims.

Information	Retention period or deletion trigger
Account information	[State the period, including after account closure]
Uploaded financial records and generated results	[State retention and deletion rules]
Subscription, payment, and tax records	[State relevant legal retention periods]
Support messages and security logs	[State separate retention periods]
Backups and provider-held copies	[State deletion or expiry schedules]

You may request deletion by emailing [email protected]. Any available account deletion controls will explain what they remove and when deletion takes effect.

Deletion may not immediately remove information from backups or records retained for a lawful purpose. We restrict use of retained information and remove it when the applicable retention requirement ends.

Subscription cancellation, account closure, and data deletion are separate requests unless the relevant process expressly combines them.

Keep independent copies of financial records you are required to retain.

8. AI Processing and Automated Decisions

Lotus365 uses AI to read submitted records and produce accounting information for your review. Documents and extracted content may contain personal information.

AI data handling: [Identify what uploaded content, extracted text, prompts, and outputs are sent to AI or OCR providers, and any minimisation or redaction applied.]

Training and retention: [State whether Lotus365 or any provider uses inputs or outputs to train models, the applicable user choices, and provider retention periods. Include only verified commitments.]

AI outputs can contain errors and should be checked against original records before use.

The bookkeeping workflow is designed to assist user review. Any other use of automated decision-making or profiling must be described here:

Automated decisions: [Confirm whether any solely automated decisions have legal or similarly significant effects. If applicable, explain their purpose, main factors, consequences, and available safeguards.]

Where applicable law provides rights to challenge automated decisions or request human intervention, contact [email protected].

9. Service Providers and Third-Party Services

The providers involved in processing information are listed below.

Service category	Provider and privacy-policy link	Processing locations
Hosting and database storage	[Actual provider and link]	[Countries or regions]
AI and document recognition	[Actual providers and links]	[Countries or regions]
Payment processing	[Actual provider and link]	[Countries or regions]
Email and customer support	[Actual providers and links]	[Countries or regions]
Optional analytics, if used	[Actual provider and link, or “Not used”]	[Countries or regions, if applicable]

If you choose to connect an independently operated service, review its privacy notice and the permissions requested. Its independent processing is governed by its own notice; our processing remains subject to this policy and applicable law.

10. Cookies and Similar Technologies

Cookies or similar technologies may support authentication, security, preferences, and any disclosed optional analytics.

Actual technologies used: [List cookie or storage names, providers, purposes, lifetimes, and the applicable consent requirements.]

Where consent is required, optional technologies will be enabled only after you agree. You can change your choices through [Describe the available preference controls].

Browser settings can also limit cookies, although blocking essential technologies may affect sign-in or other requested functions.

11. Changes to This Policy

We may update this policy to reflect changes in the Service, our processing arrangements, or applicable law.

We will publish the revised policy and update its date. Material changes will be communicated through an appropriate channel, and we will obtain consent where legally required.

This policy explains our practices. Reading it or using the Service does not, by itself, provide consent for processing that requires a separate choice.

12. Contact Us

For privacy questions, requests, or complaints, contact:

Data protection officer or representative, if applicable: [Insert name or role and contact details, or remove if not applicable.]