Privacy Policy
1. Who we are
Lyrakart Customer Mobile App ("Lyrakart") builds native iPhone and Android shopping apps for online stores. A store connects its e-commerce platform to Lyrakart, designs its app in our dashboard, and publishes the app under its own name.
Lyrakart is a product of PRS CLOUD TECH PRIVATE LIMITED (CIN U62013DC2026PTC474428), registered office Jain Road, Jai Jawala Mandir, Near Hanuman Properties, Delhi 110059, India, office H-65, Sector 63, Noida, India 201301 ("we", "us").
This policy covers the Lyrakart service on every store platform we support, its merchant dashboard, the shopping apps built with it, and our websites lyrakart.com and app.lyrakart.com. Most of the policy is the same for every platform. Section 5 explains where the data flow differs by platform.
2. Whose data this covers
- Merchants and their staff: the stores that use Lyrakart and the people who sign in to the dashboard. For staff accounts and billing we decide how the data is used.
- Shoppers: people who use a store's shopping app. The store (the merchant) decides how its shoppers' data is used. We process that data for the merchant and only on the merchant's instructions. If you are a shopper, the store's own privacy policy also applies to you.
- Website visitors: people who visit lyrakart.com or the public pages of app.lyrakart.com.
3. What we collect and why
| Data | Source | Why we use it |
|---|---|---|
| Store details: store address (domain), store name, owner email, currency, time zone, plan | The store platform, or the merchant at sign-up | To connect the store, run the service and contact the merchant |
| Store connection credentials: an access token or API key for the store platform | The merchant, when they connect the store | To read and write the store data the app needs (see section 5) |
| Catalogue: products, variants, categories or collections, stock, prices, discounts, languages, store content | The store platform | To show the store's catalogue in the app and keep stock and prices current |
| App design: app name, logo, colours, screens, navigation, store listing text | The merchant | To build and publish the merchant's app |
| Staff accounts: name, email, role, sign-in and change history. On platforms where staff sign in with a Lyrakart password, a scrypt hash of the password (never the password itself) | The merchant and the store platform | To provide accounts, apply roles and approvals, and keep an audit trail |
| Shopper summary: platform customer ID, email stored as a one-way hash, customer tags, marketing-consent flag, number of orders, total spent, last order date | The store platform | To build push audiences, run automations such as welcome and win-back messages, and link an app install to a customer |
| Order summary: order number, totals, currency, payment and delivery status, discount codes, whether the order came from the app, linked customer ID | The store platform | To show which orders came from the app or a push message, report revenue, and send order-status messages |
| Shopper details typed into the app: email, name and phone for appointment bookings, quotes, contact and newsletter forms | The shopper | To provide that feature for the merchant |
| Cart, wishlist, recently viewed products, gift registry | The shopper | To keep the cart and wishlist between visits, and to send abandoned-cart or back-in-stock messages the shopper has agreed to |
| Device details: install ID, platform, model, OS and app version, language, country, time zone, push token, notification permission | The shopper's device | To deliver push messages the shopper has allowed, show the right language, and fix app problems |
| App activity: screens viewed, taps, searches, push opens, links opened | The shopper's device | To give the merchant analytics about their app and measure campaigns |
| Optional shopper content: community posts and comments, live-show chat, shopping-assistant questions, prescription uploads | The shopper, only in apps where the merchant has switched the feature on | To provide the feature for the merchant |
| Billing and licence: plan, subscription status and charge records (Shopify); licence status (Odoo) | Shopify billing, or our Odoo module when it connects | To charge for the service, or to check the Odoo licence. We never see card or bank details |
| Messages you send us: your email address and what you write | You | To answer you |
We use this data only to provide Lyrakart. We do not sell personal data. We do not use it for advertising. We do not make automated decisions about shoppers that have legal or similar effects.
Payments for orders are taken by the store's own checkout on its platform. We never see or store a shopper's card or bank details. Shoppers can turn off notifications at any time in their phone's settings. Merchants decide which optional features are on in their app.
4. How the data is protected
A short summary. The full list is in our security overview.
- Traffic between the apps, our servers and the store platforms uses HTTPS (TLS).
- Store access tokens, API keys and other credentials are encrypted before they are stored.
- Shopper contact details and notes in appointment bookings, quotes and contact messages are encrypted by our software before they are stored. Emails used for matching are kept as one-way or keyed hashes.
- Staff access is limited by role. Reads of shopper personal data by staff are written to an audit log.
- Backups are encrypted before they leave the server.
5. Store platform connections
Lyrakart connects to the store's platform through that platform's official API, using credentials the merchant grants. We read and write only what the app needs. The differences per platform are below.
Shopify
- Connection: the merchant installs the Lyrakart app from Shopify and approves the permissions it asks for. Shopify gives us an access token, which expires and is refreshed automatically. We store it encrypted. Merchant staff sign in through the Shopify admin.
- What we read: products, collections, stock, discounts, markets, languages and store content. Customer and order details are read only as far as Shopify approves our access to protected customer data. We store a shopper's email only as a one-way hash. We do not copy names, phone numbers or addresses from Shopify customer records.
- Webhooks: Shopify sends us messages when store data changes. We store each message encrypted, delete handled customer and order messages after 7 days, and delete every message after 30 days.
- Shopper sign-in and checkout: shoppers sign in with the store's Shopify customer account, on Shopify's sign-in page. Checkout is Shopify's own checkout. We never see shopper passwords or card details.
- Billing: Shopify merchants pay for Lyrakart through Shopify's billing. We receive the plan and charge status, not card details.
- Privacy requests from Shopify:
- customers/data_request: when a shopper asks the store for their data, we build a report of what we hold about them. The store owner gets an email and a notice in the dashboard, and passes the report to the shopper. The report is deleted after 30 days.
- customers/redact: when a shopper asks the store to erase their data, we delete or make anonymous the data we hold about them. We start as soon as the request arrives and finish within 30 days.
- shop/redact: Shopify sends this 48 hours after a store uninstalls the app. We then delete that store's data. If the request never arrives, we delete the store's data 30 days after uninstall anyway.
- Account deletion in the app: after deleting the data we hold, the app also asks Shopify to erase the customer record in the store. Shopify only accepts this if the merchant has granted the customer-data-erasure permission.
Odoo
- Connection: the merchant installs our Odoo module, Lyrakart Mobile App, and presses Connect. The module creates a separate Odoo user, "Lyrakart Connector", with limited rights (sales, inventory, contacts, and billing if Accounting is installed), creates an API key for it, and sends us: the Odoo address, database name and database ID, the connector login and API key, the module and Odoo versions, and the name and email of the Odoo user who connected it, with their company name, country and currency. We use that email to create or link the merchant's Lyrakart account. We check the details by calling the store's Odoo back, and we store the API key encrypted.
- What we read: about once a minute we read changed products, categories, stock, orders (confirmed, done or cancelled) with their invoice and payment status, and the customers who placed them. We keep summary copies: catalogue, order summary, and a customer summary with the email stored only as a one-way hash.
- What we write: carts and orders made in the app, notes the shopper adds to an order, shopper sign-ups (as Odoo portal users), profile and address changes the shopper makes, a marketing opt-out, and password-reset requests. Orders from the app are marked so the merchant can see where they came from.
- Shopper sign-in: the shopper signs in with their account on the store's Odoo site. Their email and password pass through our server to the store's Odoo login. We do not store the password. After sign-in we issue our own sign-in token, valid for 7 days. The shopper's name, phone and addresses are read from Odoo when the app needs them and are not stored by us.
- Checkout: for each app install we hold the store's Odoo website session cookie, encrypted, so the cart follows the shopper. At checkout the app opens the store's own Odoo checkout page with that cookie. Payment is taken by the store's Odoo checkout. If the shopper enters an email and country for the cart, we keep them with this session.
- Purchase: Odoo merchants buy our module once on the Odoo Apps Store. Odoo SA takes the payment and holds the payment details; we do not receive them.
- Module required: the app serves the store only while our module is installed in that Odoo database. If the module is uninstalled, the app stops serving the store, and the data we hold stays until the merchant disconnects or asks us to delete it.
- Disconnecting: when the merchant disconnects Odoo in the dashboard, we delete the stored API key, stop reading, and delete the store's data 30 days later unless the merchant connects again before then.
- Account deletion in the app: deletes the data we hold about the shopper. It does not delete the customer record in the store's Odoo. That record belongs to the merchant, and the shopper should ask the store to delete it.
Other platforms
When we add a platform such as WooCommerce, CS-Cart or Magento, the connection uses that platform's official API with credentials the merchant grants. We read and write only what the app needs: catalogue, stock, the order and customer summaries listed in section 3, and the carts, orders and sign-ups made in the app. Before we connect a new platform we will add a section for it here.
6. Who processes data for us
| Provider | What it does | When |
|---|---|---|
| A hosting provider in India | Runs our app server in Delhi, India, which holds the database and uploaded files | Always |
| Contabo GmbH | Stores our encrypted backups in its EU data centre. The key that opens them is not on that server | Always |
| eWebGuru | Sends our emails (SMTP): account, sign-in, billing and notification emails | Always, for emails we send |
| Apple and Google | Deliver push messages (Apple Push Notification service, Firebase Cloud Messaging) and publish the merchant's app in the App Store and Google Play | When a merchant publishes an app and sends push messages |
| Shopify | Runs the Shopify store, its customer accounts, checkout and our billing for Shopify merchants | Shopify merchants only |
| Expo (EAS Build) | Builds the merchant's app from its design, app settings and signing credentials. No shopper data | When we build a merchant's app with it |
| A third-party AI model provider | Used only when the merchant uses AI features (drafting app content, the shopping assistant). We send only what the feature asks for: for drafting app content and push messages, the merchant's brief and a summary of its catalogue; for the shopping assistant, the shopper's message, the last few turns of that chat, the store's FAQ answers and details of matching products. | Only when the merchant uses AI features. AI features are not available to Odoo stores |
Services the merchant connects. A merchant can connect other tools, for example AppsFlyer or Branch for install attribution, Mux or Cloudflare for live video, a reviews, loyalty or email-marketing tool, or an export destination. Data goes only to the tools the merchant chooses, under the merchant's own account with that tool.
Authorities. We share data with authorities only where the law requires it.
7. International transfers
Our company is in India and our app server is in Delhi, India. Our backups are stored in the European Union, at Contabo GmbH's EU data centre; they are encrypted before they leave our server. Some of the other providers above, such as Shopify, Apple, Google, Expo and the AI model provider, may process data in other countries. Where the law of a shopper's or merchant's country needs a transfer agreement, merchants can ask us for one.
8. How long we keep data
- Shopper and store data: kept while the merchant uses Lyrakart.
- Account deletion by a shopper in the app: the data we hold is deleted straight away. Records the merchant needs for business are made anonymous instead (for example quotes and appointment bookings).
- Deletion requests through the older request route: held for 7 days by default before the data is deleted. The merchant can set this between 0 and 30 days.
- Shopify webhook messages: 7 days for handled customer and order messages, 30 days for all others.
- Data request reports: 30 days.
- Contact messages sent through an app: 400 days.
- When a merchant leaves: on Shopify, we delete the store's data after Shopify's shop/redact request, or 30 days after uninstall at the latest. On Odoo, we delete the store's data 30 days after the merchant disconnects Odoo in the dashboard. On any platform, a merchant can ask us at any time to close their account and delete their data.
- Backups: kept 7 days on our server and 14 days on the backup server. So deleted data leaves the backups within 14 days.
- Records of privacy requests: after a request is done we keep a record that it happened, with IDs only and no contact details.
- Copies a merchant has exported to their own tools are in the merchant's hands and we cannot recall them. If the law requires us to keep something longer, we keep only that.
9. Your rights and how to delete your data
- Shoppers can ask for a copy of their data, a correction or deletion. The quickest route is to contact the store whose app you use; we help the store answer.
- Delete your account in the app: if the app lets you create an account, you can delete it from inside the app. You confirm once, and the data we hold about you is deleted straight away. Each app also has a deletion web page, so you can ask without the app: you enter your email, we send you a code, and you confirm with that code.
- Merchants and staff can write to us directly at the address below.
We reply within the time the law that applies to you allows.
10. Children
Lyrakart is not meant for children under 18. We do not knowingly collect data from children. If you believe a child has used it, write to us and we will delete their data.
11. Cookies
- Merchant dashboard: where staff sign in with a Lyrakart password, the dashboard sets a signed sign-in cookie (lasts up to 30 days) and a short-lived security cookie for its forms (lasts 2 hours). The Shopify dashboard runs inside the Shopify admin and uses Shopify's own sign-in.
- Checkout: on Odoo, the app opens the store's checkout page with the store's own website session cookie, described in section 5. On Shopify, checkout is Shopify's page and Shopify sets its own cookies.
- Our websites: lyrakart.com and the public pages of app.lyrakart.com set no tracking or advertising cookies and run no analytics. They load fonts from Google Fonts, so your browser connects to Google to fetch them. Like any web server, ours may log basic request details such as IP address, page and time.
12. Changes
If we change this policy we will update the date above. We will show significant changes in the Lyrakart dashboard before they take effect.
13. Governing law
This policy is governed by the laws of India. The courts at Delhi, India have exclusive jurisdiction, as set out in our Terms of Service.
14. Grievance officer
If you have a complaint about how we handle personal data, write to our grievance officer. We will acknowledge your complaint and respond to it.
Mukesh Kumar, Grievance Officer
PRS CLOUD TECH PRIVATE LIMITED
H-65, Sector 63, Noida 201301, India
Email: info@lyrakart.com
15. Contact
PRS CLOUD TECH PRIVATE LIMITED
Email: info@lyrakart.com
Registered office: Jain Road, Jai Jawala Mandir, Near Hanuman Properties, Delhi 110059, India
Office: H-65, Sector 63, Noida, India 201301
Terms of Service · Privacy policy · Data Processing Addendum · Security overview