Privacy Policy

1. Introduction

This Privacy Policy is issued by LOCKANDOPEN LLP ("LOCKANDOPEN LLP", "we", "us", or "our"), a Limited Liability Partnership incorporated under the laws of India. For the purposes of the Digital Personal Data Protection Act, 2023 and other applicable data protection laws, LOCKANDOPEN LLP is the Data Fiduciary in respect of digital personal data for which it determines the purpose and means of processing.

This Privacy Policy applies to your access to and use of lockandopen.in (the "Site") and the products and services operated by LOCKANDOPEN LLP under the LockAndOpen brand (collectively, the "Services"), including:

• ScholarSuite (scholar-suite.app) — an intelligent research workspace that may process research, documents, knowledge materials, and AI-assisted workflows.
• PicStream (picstream.in) — a web-based visual workspace that may process images and related inputs for discovery, creation, transformation, organisation, storage, and AI-powered visual features.

This Privacy Policy explains how we collect, use, store, disclose, retain, and protect digital personal data in connection with the Services, including account registration, product usage, customer support, and, where applicable, paid subscriptions, billing, payments, cancellations, and refunds. It also describes the choices and rights available to you as a Data Principal under applicable law.

Where processing is based on consent, we will seek consent in accordance with applicable law and provide a practical method to withdraw it. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal, and may affect your ability to use certain features of the Services.

This Privacy Policy should be read together with our Terms of Service and, where you purchase or manage a paid subscription, our Refund & Cancellation Policy. Rules regarding refunds, cancellations, renewals, and storage downgrades are set out in the Refund & Cancellation Policy and are not restated in full here.

2. Notice and Consent

Where consent is required, we will provide a clear notice identifying the personal data to be collected, the purpose for processing, and the services or uses enabled by that processing. We will provide practical mechanisms to give, manage, and withdraw consent where required by applicable law.

We do not require consent for processing where applicable law permits processing without consent, including specified legitimate uses recognised by law.

3. Information We Collect

A. Personal Information

When you create an account or use our Services, we may collect:

• Full name
• Email address
• Profile information
• Authentication data via third-party sign-in providers such as Google or Microsoft, or through direct email-based account authentication, depending on the Service and option you choose

B. Usage Data

We automatically collect certain technical information when you visit or use our Services, including:

• Browser type and version
• Device type and operating system
• IP address
• Pages visited and features used
• Date, time, and duration of visits

C. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, maintain sessions, and analyse usage patterns. You may control cookie preferences through your browser settings, though disabling cookies may affect certain features of our Services.

D. Product Usage & Feature Interaction Data

Scholar Suite collects usage data generated through your interaction with its research and AI-assisted features, including but not limited to:

• Queries and interactions submitted within the research workspace
• Documents, research papers, PDFs, and other content you upload or process
• Results, citations, analyses, and other outputs generated within the Service
• Feature interaction patterns (which capabilities you use, how often, and in what sequence)

This data is used to provide and improve the Service. Certain feature usage data may also be used to train, fine-tune, evaluate, and improve our own AI models where permitted by applicable law and on the applicable lawful basis described in this Policy.

PicStream collects:

• Image search queries and related filters
• Images and prompts you submit for AI generation, transformation, editing, or enhancement
• Collections, uploads, exports, and other organisational actions you take within the workspace
• Application performance and error logs

E. Communication Data

• Emails and messages you send us
• Support requests and chat interactions with LockBot or our team

F. Payment & Subscription Information

When you purchase a subscription or use a paid service, we may collect or receive information related to your subscription and payment, including:

• Subscription plan and billing period
• Subscription status
• Payment status
• Transaction or payment reference ID
• Payment amount and currency
• Payment date
• Refund or cancellation information
• Billing-related communications
• Optional billing address and GSTIN / tax ID you provide for invoicing

Payments may be processed by third-party payment service providers. We do not store your complete debit card, credit card, UPI credentials, bank account credentials, or other sensitive payment authentication information unless explicitly required and handled in accordance with applicable law.

The information we receive from payment providers may be used to process subscriptions, confirm payments, manage cancellations and refunds, prevent fraud, provide customer support, and comply with applicable legal and financial obligations. Refund and cancellation rules are described separately in our Refund & Cancellation Policy.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Authenticate your identity
• Process and store your uploaded content
• Manage your account and preferences
• Respond to inquiries, support requests, and feedback
• Send service-related notifications (not marketing, unless you opt in)
• Monitor and analyse usage patterns to improve product experience
• Detect, prevent, and address technical issues, fraud, and abuse
• Process subscription payments and transactions
• Verify and manage subscription status
• Manage billing, cancellations, and refunds
• Respond to payment and billing-related inquiries
• Detect and prevent fraudulent or unauthorized transactions
• Maintain financial and transaction records where required by applicable law
• Comply with applicable legal obligations

Subscription and Billing Communications

If you purchase or subscribe to a paid service, we may send you service-related communications regarding:

• Payment confirmation
• Subscription activation
• Subscription renewal
• Failed or unsuccessful payments
• Subscription cancellation
• Refund requests and refund status
• Changes to your subscription or billing
• Other important payment or account-related information

These communications are necessary to provide and manage the applicable service and are different from optional marketing communications.

AI Features and Model Training

Certain AI-powered features may use feature usage data — including queries, documents, images, prompts, and interaction patterns — to train, fine-tune, evaluate, and improve our own AI models. Where this processing is based on consent, we will obtain and manage that consent in accordance with applicable law.

What this means in practice:

• Where permitted by applicable law, relevant usage interactions may be used as training signals for our own models; we do not use your personal identity itself as a training target.
• Some features may be powered by third-party AI providers, including services from Google and Microsoft. Your queries, documents, images, and prompts may be processed by those providers to generate results. Where applicable, we use commercial service terms intended to restrict providers from using submitted content to train their own models; the specific terms applicable to a service may vary.
• Data used to train our own models is processed on our secured, encrypted internal infrastructure and is not shared with external AI providers for their model training purposes.
• Where AI model training uses personal data on a consent basis, you may withdraw that consent as provided by applicable law.

Where an AI feature requires a particular processing activity to operate, the applicable notice will explain that requirement before use. Where consent is required, it will be obtained separately where appropriate and withdrawal will be made available as required by law. For questions, contact [email protected].

5. Processing Grounds

We process digital personal data for specified purposes and on a lawful basis under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025 to the extent applicable and in force, and other applicable law. Depending on the processing activity, the applicable ground may include:

Where consent is the applicable basis, we will provide notice describing the personal data to be collected and the purpose for processing, and we will provide a practical method to withdraw consent in accordance with applicable law.

6. Information Sharing

We do not sell, rent, or trade your personal information to third parties.

We may share your information only in the following limited circumstances:

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access controls and authentication mechanisms designed to restrict access to account data to the account holder and to systems or personnel that require access to operate the Services
• Access and usage logging to help detect and respond to unauthorized activity
• Regular security assessments
• Internal staff guidelines on data handling and protection

Please note that no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Personal Data Security Incidents

We maintain reasonable technical and organisational security measures designed to protect personal data and to detect and respond to security incidents. Where a personal data breach is required to be notified under applicable law, we will notify affected Data Principals and the relevant authority in the form and within the timelines prescribed by applicable law.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined in this policy:

To request deletion of your data, contact us at [email protected].

10. Your Rights

Subject to applicable law and any conditions or exceptions provided by law, you may have the following rights as a Data Principal under the DPDP Act:

• Right to Access Information — Request information about the personal data being processed and related processing information, as provided by applicable law
• Right to Correction and Erasure — Request correction of inaccurate or incomplete personal data and erasure where retention is no longer necessary or otherwise permitted by applicable law
• Right to Grievance Redressal — Raise a grievance regarding our processing of your personal data
• Right to Nominate — Nominate another individual to exercise rights in accordance with applicable law
• Right to Withdraw Consent — Where processing is based on consent, withdraw that consent through the available mechanism; withdrawal does not affect processing already carried out lawfully before withdrawal

To exercise your rights or raise a grievance, contact us at [email protected] or [email protected]. We will handle requests in accordance with applicable law and the timelines that apply to the relevant request.

11. Third-Party Sign-In

You may create an account using email-based authentication or, where supported by the relevant Service, sign in using a third-party provider such as Google or Microsoft. The LockAndOpen website may support Google sign-in, while Scholar Suite and PicStream may support Google, Microsoft, and email-based authentication. When you use a third-party sign-in provider, we receive limited profile information (such as your name and email address) as permitted by that provider's policies. We do not receive or store your password for that provider. Your use of third-party sign-in is also subject to that provider's own privacy policy.

12. Cookies Policy

We currently use cookies and similar technologies for the following purposes:

• Session Management — To keep you logged in and maintain your active session while using our Services.
• Analytics — Via Google Analytics 4, to understand how users interact with our Services in aggregate and improve the product experience.

We may in the future expand our use of cookies to include:

• Preference cookies: To remember your settings and customisations across visits.
• Performance cookies: To monitor and optimise the speed and reliability of our Services.

We will update this policy and notify users before introducing any new categories of cookies beyond those listed above.

You may disable or manage cookies through your browser settings. Disabling session cookies will prevent you from staying logged in and may impact core functionality of the Services.

13. Children's Privacy

Under the DPDP Act, a child is an individual who has not completed eighteen years of age. Where applicable, we will obtain verifiable parental or lawful guardian consent before processing a child's personal data and will apply the additional requirements applicable to children's data.

We will not knowingly undertake processing prohibited by applicable law in relation to children, including any prohibited tracking, behavioural monitoring, or targeted advertising, where such restrictions apply.

Parents or lawful guardians may contact us at [email protected] regarding a child's personal data or to request action in accordance with applicable law.

14. Data Location and International Transfers

LOCKANDOPEN LLP is based in India. Our primary application servers, databases, and company-operated service infrastructure are hosted and maintained in India, and we aim to keep primary user data within India-based infrastructure.

Where we use third-party service providers, a provider may process information in locations required to deliver its service. We configure services for India-based regions where available and appropriate. Where applicable law requires safeguards for processing outside India, we will apply the requirements that govern such processing.

If you access the Services from outside India, your information may still be processed through our India-based infrastructure and through third-party service providers used to operate particular features.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will:

• Post the updated policy on this page
• Update the "Last Updated" date at the top
• Notify registered users by email for material changes

Your continued use of our Services after any changes constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to the appropriate team: