Privacy Policy

LocallyBot (operated by HuddleStack, “we”, “us”) is a local business directory serving communities in India, available at locallybot.com and through the LocallyBot mobile app. This policy explains what personal data we collect, why, how we protect it, and the rights you have — including your rights under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). Questions: admin@huddlestack.com.

We collect only what the Service needs to work:

• Account details — name, email address, optional phone number and profile photo, and sign-in identifiers when you use Google or Apple sign-in.
• Location — approximate or precise location, only when you allow it, to show nearby businesses and improve search results. You can use most of the Service without sharing location.
• Content you create — reviews, photos, messages to businesses, posts, booking and pickup-order details, and voice search queries (transcribed to process your request).
• Device and usage data — device type, app version, language setting, pages viewed, and push-notification tokens if you enable notifications.

Your device calendar.In the mobile app, an appointment you have booked has an “Add to phone calendar” button. Tapping it opens your device’s own calendar app with the appointment details filled in, and you choose whether to save it. We do not read your calendar — we cannot see your existing events, and no calendar data is ever sent to us or to anyone else. Nothing happens unless you tap that button.

We do not collect government IDs, payment card numbers, or biometric data.

• Operate the directory: search, listings, reviews, messaging, bookings, and orders.
• Show nearby results and language-appropriate content (English / Hindi).
• Power AI features — voice search and AI chat send your query text, and any voice recording you make, to OpenAI (or Amazon Bedrock as a backup) to generate a response. See section 4. The app asks your permission in a separate screen before this sharing happens. Queries are not used to build advertising profiles.
• Send notifications you have opted into (alerts, order updates, messages).
• Keep the Service safe: prevent spam, fraud, and abuse; enforce our Terms.
• Comply with legal obligations.

We do not sell your personal data, and we do not show third-party ads. We share data only with:

• Businesses you contact — when you message, review, book, or order from a business, that business sees your name, your message or order, and the phone number you provided for the order.
• Legal requirements— when required by law, court order, or to protect users’ safety.

Service providers (processors). These are the third parties that currently process personal data on our behalf, and what each one receives. They act only on our instructions and may not use your data for their own purposes:

• Amazon Web Services — hosting, database, media storage, and content delivery. Holds essentially all data described in section 2. Also provides Amazon Bedrock, used as a backup AI provider when our primary AI provider is unavailable.
• OpenAI — powers AI search and chat, voice transcription, text-to-speech, content moderation, and reading business details out of photos and websites. Receives the text of your queries and messages, voice recordings you make for voice search, and images you upload for listings or moderation. We show an in-app permission prompt that names these providers and what is sent. Assistant features — AI search and chat, voice transcription, text-to-speech, drafting, and reading details out of photos or websites — send nothing until you tap Allow. Safety screening of posts and uploads runs either way, so we can filter abusive content.
• Google — Sign in with Google (receives your sign-in identity), and the Google Places service, used to show current ratings and reviews on a business page.
• Apple — Sign in with Apple (receives your sign-in identity).
• Google Firebase Cloud Messagingand your browser’s push service — deliver push notifications you have opted into. Receive your device push token and the notification text.
• Payments — not used during the Alwar launch (every listing is free). If paid plans launch later, a payment processor would receive your email and payment metadata only if you buy a plan. Card details would be entered with that processor; we never receive or store them.
• ipinfo.io — converts an IP address to an approximate city so we can detect abuse and suspicious sign-ins. Receives your IP address.
• OpenFreeMap — supplies map tiles when you view a map. Receives the map area being displayed.

Under our agreements with them, our AI providers do not use your content to train their models. Several of these providers operate outside India, so your data may be processed in other countries, including the United States.

Every third party listed above is bound by contract to provide the same or equal protection of your personal data as this policy describes and as the App Store Review Guidelines require. They may process your data only on our instructions, only for the purpose listed, and may not sell it or use it for their own advertising.

Assistant features share with our AI providers only after you tap Allow on the in-app permission prompt; safety screening of what you post runs regardless. You can withdraw that permission at any time in Voice & AI settings; the rest of the app, including typed search, keeps working.

If we add or replace a processor, we will update this list. Where we no longer use a provider, it is removed.

Data is stored on Amazon Web Services infrastructure. All traffic between your device and our servers is encrypted in transit (HTTPS/TLS). Passwords are stored hashed, never in plain text. On the mobile app, sign-in tokens are kept in the device’s secure storage (iOS Keychain / Android Keystore). Access to production data is restricted and audited, and we run automated security scanning on our code and dependencies.

We keep personal data while your account is active. If you delete your account, personal data is removed as described in section 7 and residual copies in encrypted backups are purged on the normal backup rotation within 30 days. Records we must keep for legal, safety, or fraud-prevention reasons are retained only as long as the law requires.

Under the DPDP Act and this policy you can:

• Access and correct your data — most details are editable in Dashboard → Profile or by contacting support.
• Delete your account — in the app under Dashboard → Profile → Delete account, or follow the steps on Delete your account. Deletion removes your name, email, phone, photo, credentials, saved items, and preferences immediately; reviews and messages remain anonymized as “Deleted User”.
• Withdraw consent — turn off location or notifications in your device settings at any time; the related features simply stop working.
• Raise a grievance — see section 11.

We respond to verified requests within 15 days. To make a request by email, write to admin@huddlestack.com from your registered email address.

LocallyBot is for adults. You must be at least 18 years old to create an account or use the Service, as set out in our Terms of Use. The Service is not directed at children, and we do not knowingly collect personal data from anyone under 18.

This also aligns us with the DPDP Act, which treats everyone under 18 as a child and requires verifiable parental consent before their data may be processed. Because we do not permit under-18 accounts at all, we do not knowingly process children’s data and that consent requirement does not arise.

If you believe someone under 18 has created an account, contact us at admin@huddlestack.com and we will verify and delete it, along with the personal data associated with it.

We use local storage and cookies for essential functions only: keeping you signed in, remembering your language and theme, and protecting against abuse. We do not use third-party advertising or cross-site tracking cookies.

Directory listings combine owner-submitted information with data from lawful public sources such as OpenStreetMap (see How we source listings). Business owners can claim, correct, or request removal of their listing via Remove my listing.

If you have a complaint about content on the Service or about how your data is handled, contact our Grievance Officer:

Hemant Kumar Saini, Grievance Officer, LocallyBot (HuddleStack)
Email: admin@huddlestack.com (subject line: “Grievance”)

Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we acknowledge grievances within 24 hours of receipt (reply confirming we have logged your complaint and a reference, where available) and endeavour to resolve them within 15 days. Resolution may include content removal, account restriction, clarification, or referral where appropriate.

You can also report specific content in the app via Report an issue, use chat Block / Report on Messages, or see Support for the same grievance contacts. Community standards live in our Terms of Use §5.

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date and, where appropriate, by additional notice such as a banner, in-app message, or email. Continued use of the Service after changes constitutes acceptance.

Privacy questions and data requests: admin@huddlestack.com. See also our Terms of Use.