1. Scope, operator and our different roles
Loomfast is operated by LOOMFAST PRIVATE LIMITED (“Loomfast”, “we”, “us” or “our”), with its office at Door No. E 1 - P 27, 29/1899, 2nd Floor, Venture Arcade, Mavoor Road, Thondayad, Kozhikode, Kerala 673016, India.
This Policy applies when you visit loomfast.com, create or use a Loomfast account, use the customer app, laundry/business app, Hub admin webapp or Marketplace, make a booking or payment, contact support, or otherwise interact with us.
When Loomfast determines the purpose
We act as the data fiduciary/controller for data used to run accounts, subscriptions, Marketplace bookings, payments, security, support, communications, compliance and improvement of our own Services.
When a laundry Business determines the purpose
A Business using Loomfast Hub generally decides why and how to process information about its customers, employees, suppliers and operations. For that data, the Business is the data fiduciary/controller and Loomfast acts primarily as its processor/service provider. The Business’s own privacy notice also applies. Requests about such data should usually be directed to that Business; we will reasonably assist it.
References to DPDP rights and duties apply when the relevant provisions commence. Under the notified phased schedule, most substantive processing duties and individual rights are scheduled to take effect on 13 May 2027; this Policy does not represent that every provision is already enforceable.
This Policy is designed to address the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and to support the phased implementation of the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 as their relevant provisions take effect.
2. Personal data we collect
- Identity and account data: name, email, phone number, business name, role, account identifiers, login status, verification records and hashed passwords. We do not store your password in readable form.
- Business and tax data: branch/outlet details, business address and location coordinates, country/state/city, logo, GSTIN, PAN, place of supply, tax regime, invoice settings, licences or verification information.
- Customer and marketplace data: contact details, addresses, saved addresses, booking and order history, garment/service details, preferences, notes, loyalty points, pickup and delivery instructions, complaints, reviews and communications.
- Order media: photographs of garments, care issues or order evidence uploaded by a Business or user. Such images may incidentally contain people, locations or other personal information.
- Employee and HR data: name, work contact details, role, permissions, branch/outlet assignments, attendance, leave, salary and payroll records entered by a Business.
- Supplier and finance data: supplier contacts, purchase and expense records, invoices, ledgers, taxes, payment method/status and transaction records.
- Payment data: amount, currency, status, coupon, gateway order/payment identifiers, refund and settlement information. Card, UPI or bank credentials entered into a payment gateway are handled by that gateway; Loomfast does not intend to store full card details or payment authentication credentials.
- Device and usage data: IP address, browser and device type, timestamps, pages/features used, session and authentication events, error logs, security signals and approximate location inferred from IP.
- Communications: support requests, product feedback, survey responses, email delivery status, and messages you send through the Services.
Depending on enabled features, saved location data can include precise latitude/longitude, address labels, building or entrance photographs and delivery instructions. Reviews, ratings and listing media may be public; account contact details and delivery addresses are shared for fulfilment rather than published as reviews.
Please do not provide Aadhaar numbers, health data, biometric data, financial credentials or other highly sensitive information unless we specifically request it through an approved, lawful feature. Avoid including unnecessary personal information in free-text fields or images.
Mobile permissions and location
- Location: the customer app requests device location to find nearby laundries and help select a pickup/delivery address. You can instead search or choose a location manually. Coordinates you save or submit with a booking are sent to our service and made available to the selected laundry and authorised fulfilment staff. Revoking device permission does not erase an address already saved or submitted.
- Maps and navigation: displaying maps, searching addresses or opening directions may send coordinates, search text, IP address and device request information to map, geocoding or navigation providers. A displayed branch location or route estimate is not a promise of continuous live driver tracking.
- Photos: when you choose images for garments, addresses, listings or business profiles, we process the selected files for that purpose. Use the device picker and permission controls to choose what to share. Avoid faces, identity documents and unnecessary details of your home or other people.
- OTP verification: we use phone verification providers such as MSG91. On supported Android devices, you may approve retrieval of a single verification SMS; this does not give us general access to your SMS inbox. You can enter the code manually.
- Device controls: you can change permissions in device settings. Denying an optional permission limits the relevant feature. Signing out or uninstalling the app does not itself delete server records.
3. Where the data comes from
We receive data directly from you; from the Business that creates or manages your record; from authorised account administrators and users; from Marketplace parties involved in a booking; automatically from devices and servers; and from payment, email, storage, maps/geocoding, security and other service providers. We may also receive lawful public business information and information required to prevent fraud or comply with law.
4. How we use personal data
- create, verify, authenticate and administer accounts and access permissions;
- provide Hub workflows for branches, CRM, orders, pickup/delivery, HR, accounting, reports and settings;
- publish Marketplace listings, find nearby Businesses, process bookings, track services, communicate status and support disputes;
- process subscriptions, commissions and marketplace payments; issue refunds; reconcile transactions; and maintain tax/accounting records;
- send service, verification, security, billing and support communications and, with any consent required by law, product or promotional communications;
- provide support, collect feedback, diagnose errors and improve usability, features, performance and reliability;
- protect users and the Services, enforce our Terms, prevent fraud and abuse, audit access, investigate incidents and maintain backups;
- comply with legal obligations, lawful requests, taxation, accounting, dispute resolution and enforcement; and
- create aggregated or de-identified insights that do not identify an individual or Business.
We will not use personal data for a new incompatible purpose without an appropriate notice and, where required, consent.
5. Consent and other lawful processing
Depending on the context and law in force, we process personal data with consent; to provide a service or take steps you request; for uses voluntarily provided for a specified purpose; to comply with law; to respond to emergencies, fraud and security risks; and for other uses expressly permitted by applicable law. A contractual relationship or general business interest does not override a requirement for consent, notice or another statutory ground.
Where we rely on consent, it is requested through the relevant interface or communication. You may withdraw it by the same or a comparably easy method or by contacting us. Withdrawal does not affect prior lawful processing and may prevent us from providing a feature that needs the data. We will explain material consequences where practical.
Businesses must independently establish an appropriate lawful basis and provide required notice for the personal data they put into Loomfast Hub.
7. Business-controlled records
If a Business entered your customer, employee or supplier information, contact that Business first to access, correct or erase it, object, withdraw consent, or complain. The Business may need to retain information for tax, employment, consumer or other legal obligations. We will act on the Business’s lawful instructions and may require it to verify your identity and request.
Business administrators can access workspace data and control other users’ access. If you use a work account, your employer or Business may view your account activity, change permissions, export records, suspend access or request deletion in accordance with its own policies and law.
8. Storage and transfers
We and our providers may process data in India and in other countries where infrastructure or support operates. Before transferring sensitive personal data outside India, we use contractual and organisational measures intended to provide a comparable level of protection and transfer only where necessary for the lawful contract or otherwise permitted. We will comply with any country restrictions notified under the Digital Personal Data Protection Act as they apply.
Any local storage, payment-data or cyber-security localisation requirement prevails over this general transfer description. Contact support for information about the providers or destinations relevant to your data.
Internet and cloud processing necessarily involve transmission across networks, and no location provides absolute security.
9. How long we retain data
We retain personal data only as long as reasonably necessary for the purposes described, a Business’s lawful instructions, and legal, tax, accounting, security, backup and dispute requirements. Retention depends on the record:
- active account and operational records are generally kept while the account or Business relationship continues;
- transaction, invoice, tax, consent, security and dispute records may be kept for the applicable statutory limitation or record-keeping period;
- verification/reset tokens expire after short operational periods, while security logs and backups follow operational schedules subject to mandatory retention and lawful preservation requirements; and
- after a valid deletion request or account closure, data is deleted, de-identified or isolated from active use, unless retention is necessary for law, fraud prevention, security, claims or another permitted purpose.
Where applicable, ICT logs must be maintained for at least the period and in the location required by CERT-In directions. Tax and invoice records may require longer retention. A legal hold is limited to the affected records and does not justify retaining unrelated data indefinitely.
Deletion from backups may occur on the next scheduled rotation. De-identified information that can no longer identify a person may be retained.
10. Security practices
We use safeguards proportionate to the nature and risk of the data, such as password hashing for password-based accounts, access permissions, workspace access restrictions and security logging. The controls applicable to a feature depend on its architecture. We do not promise that any system is immune from attack or claim a security certification through this Policy. We require personnel and service providers to handle personal data only as authorised.
No system is completely secure. You are responsible for strong credentials, secure devices, appropriate user permissions and prompt removal of access that is no longer needed. Report suspected unauthorised access to support@loomfast.com. Where required, we will notify affected persons and authorities of a personal data breach in the prescribed manner.
12. Children’s data
The Services are not directed to persons under 18, and minors must not independently create accounts or make bookings. A parent or lawful guardian may arrange a household service. Businesses must not enter children’s personal data unless necessary, lawful and supported by required verifiable parental consent. We do not knowingly undertake tracking, behavioural monitoring or targeted advertising directed at children.
If you believe a child’s data was collected improperly, contact us so we can investigate and take appropriate action.
13. Your choices, rights and grievance process
Subject to applicable law, role and exemptions, you may ask us to:
- confirm whether we process your personal data and provide a summary or access information;
- correct, complete or update inaccurate data;
- erase personal data no longer needed for a lawful purpose;
- withdraw consent or opt out of promotional email;
- explain the identities or categories of recipients as required by law;
- address a grievance and, when the relevant DPDP provisions apply, nominate another person to exercise rights in case of death or incapacity.
Use available account settings or email support@loomfast.com. Describe your relationship with Loomfast, the relevant Business and the request. We may verify identity and authority, and will respond within the period required by applicable law. We may deny or limit a request where law permits, including to protect another person, confidential information, security, legal claims or required records, and will explain where required.
Grievance Officer: Vivin N, Co-founder, LOOMFAST PRIVATE LIMITED
Email: support@loomfast.com
Address: Door No. E 1 - P 27, 29/1899, 2nd Floor, Venture Arcade, Mavoor Road, Thondayad, Kozhikode, Kerala 673016, India. Phone: +91 790 273 6938. We address privacy grievances within one month where the SPDI Rules apply, and within any shorter applicable legal deadline. When DPDP grievance provisions commence, the applicable notified period will govern.
Please give us a reasonable opportunity to resolve the grievance. When the relevant provisions are in force and you remain dissatisfied after using our process, you may complain to the Data Protection Board of India. Other statutory consumer or judicial remedies remain available.
Account and personal data deletion
To request deletion of a customer account or personal data, email support@loomfast.com with the subject “Account deletion request”, your registered phone/email and the app or workspace involved. You can request deletion without reinstalling the app. Do not send passwords, OTPs or identity documents in your initial request. We will verify identity proportionately before acting.
We will explain what will be deleted, what must be retained and why, and the expected completion period. We may retain transaction, tax, fraud/security and dispute records where necessary and lawful, restrict their use and delete them when that basis ends. Backups are removed through their retention cycle. Account deletion does not automatically cancel an existing laundry booking or erase the laundry’s independently held statutory records.
For a laundry/business workspace, an authorised administrator must request closure or export through support. Employee removal from a workspace does not necessarily erase employment, payroll or invoice records controlled by that Business. You may still send us a grievance directly; we will explain which party can act on the request.
14. Changes to this Policy
We may update this Policy to reflect law, technology, providers or Services. We will post the revised Policy with its effective date and provide additional notice where a change is material or law requires it. Earlier versions may be requested from us.
15. Contact us
LOOMFAST PRIVATE LIMITED
Door No. E 1 - P 27, 29/1899, 2nd Floor, Venture Arcade, Mavoor Road, Thondayad, Kozhikode, Kerala 673016, India
Privacy, account deletion and general support: support@loomfast.com
Phone: +91 790 273 6938
Contact us