Privacy Policy

1. Information we collect

• Account information: When you register, we collect your name, email address, and a hashed version of your password (bcrypt) — we never store your password in plain text. You may optionally provide a phone number at signup.
• Transaction data: We record wallet top-ups, virtual number purchases, and refunds, including amounts, timestamps, and provider order IDs.
• Usage data: We log requests and activity to diagnose issues and improve the platform.
• Device information: Your IP address is used by our rate-limiting system to prevent abuse of login and signup endpoints. It is not linked to your identity for marketing purposes and is not sold.

2. How we use your data

• To provide the service: Your email is used to identify your account and send transactional emails (email verification codes, password reset, rental-expiry notices).
• To process payments: Your wallet balance and transaction history are maintained to facilitate purchases and refunds.
• To prevent fraud: IP addresses and request patterns help us detect and block abusive behavior.
• To communicate with you: We send email notifications for significant account events. We do not send unsolicited marketing email.

3. Third-party services

• Stripe: Handles all card payment processing. Your card details are processed directly by Stripe and are never stored on Luchoo's servers. Stripe is PCI-DSS compliant.
• Resend: Delivers transactional email. Your email address is transmitted to Resend to send verification codes and notification emails.
• Our numbers provider(s): Fulfill virtual number purchases on our behalf. When you buy a number, a request is made to our provider with only the parameters needed to fulfill it (service and country) — no other personal information is shared.

4. Data retention

• Account data is retained for the lifetime of your account and for a limited period after account deletion.
• Transaction records are retained longer, to support financial record-keeping obligations.
• Server logs follow our hosting provider's platform-level retention rather than a custom retention policy we've separately defined.

The retention periods above are placeholders and will be confirmed against the specific financial and data-protection regulations of the jurisdiction Luchoo ultimately incorporates in.

5. Your rights

• Access: You may request a copy of the personal data we hold about you by emailing support.
• Correction: You can update your name and password at any time from your account settings. For other corrections (including your email address), contact support.
• Deletion: You may request deletion of your account and associated data by emailing support. Transaction records required for legal or financial compliance will be retained, anonymized where possible.
• Portability: You can export your order and transaction history as a CSV file directly from your Orders page at any time.

6. Security

• Luchoo is served over HTTPS (TLS) in production.
• Passwords are hashed using bcrypt before storage — we never store or log plain-text passwords.
• Database access is restricted to application servers only — there is no public database access.

7. Cookies

• Luchoo uses a single authentication session cookie (authjs.session-token, or __Secure-authjs.session-token in production) to keep you signed in. This cookie is strictly necessary for the service to function and does not track you across other websites.
• We do not use advertising cookies, analytics cookies, or third-party tracking scripts.

8. Legal process

We may disclose account or transaction data to law enforcement, regulators, or courts when required to do so by a valid legal process such as a court order or subpoena.

9. Contact

Questions about this policy? Reach us at support@luchoo.app.