Privacy Policy

Last Updated: October 2, 2026 · Effective: October 2, 2026

This Privacy Policy describes the policies and procedures of Upsurge Labs Pte. Ltd. (UEN: 202117431M), a company incorporated under the laws of the Republic of Singapore ("Company," "we," "us," or "our"), regarding the collection, use, disclosure, and protection of information received from users of our products and services, including the Lauki website (lauki.ai), lauki.chat (lauki.chat), the Lauki Sense macOS application, and any related services, tools, or applications (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use the Services.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to a name, email address, identification number, location data, or online identifier.

"Processing" means any operation performed on Personal Data, whether or not by automated means, such as collection, recording, storage, use, disclosure, or deletion.

"Data Controller" means the entity which determines the purposes and means of Processing. For this Privacy Policy, Upsurge Labs Pte. Ltd. is the Data Controller.

"User Content" means any data, code, text, files, images, audio, or other materials that Users submit or transmit through the Services.

2. Information We Collect

2.1 Information You Provide

• Account Data: Email address, password (stored as a bcrypt hash, never in plaintext), and account preferences.
• Payment Information: Transaction identifiers, billing details, and subscription information processed through Stripe, Inc. We do not store credit card numbers.
• User Content: Code, text, chat messages, files, images, audio recordings, and any data stored in your sandbox environment or transmitted through the Services.
• Communications: Records of correspondence when you contact us for support or feedback.

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device type, and language preferences.
• Usage Data: Features used, actions taken, session duration, and diagnostic data.
• Audio Data (Lauki Sense): Audio recordings are processed locally on your device and transmitted to third-party transcription services (Whisper API) for transcription only. Audio is not stored on our servers.
• Error Data: Crash reports and performance metrics to help maintain and improve the Services.

2.3 Information from Third Parties

• Payment Processors (Stripe): Transaction confirmations and fraud detection signals.
• Authentication Services: Basic profile information if you authenticate via Google or other third-party sign-in.

3. How We Use Your Information

3.1 Primary Uses

• Providing, operating, and maintaining the Services.
• Processing your instructions through AI models, executing code in sandbox environments, and delivering results.
• Processing payments and managing subscriptions.
• Communicating with you about the Services and providing support.
• Transcribing audio and refining text (Lauki Sense).

3.2 Secondary Uses

• Analyzing usage patterns and improving the Services.
• Detecting and preventing fraud, abuse, and security incidents.
• Complying with applicable laws and regulations.

3.3 What We Do Not Do

We do not use your User Content — including chat messages, code, files, audio recordings, or any other data submitted through the Services — to train, fine-tune, or improve AI or machine learning models. Your content is processed solely to provide the Services to you.

4. Disclosure of Information

We may share your Personal Data with the following categories of service providers, solely for the purposes described above:

• Stripe, Inc. — Payment processing and subscription management.
• Twilio / SendGrid — Transactional email delivery.
• MongoDB, Inc. — Database hosting.
• DigitalOcean — Cloud infrastructure and hosting.
• Anthropic, PBC — AI model API services for processing instructions and generating responses.
• OpenRouter — AI model routing and API gateway.
• OpenAI / Groq — Whisper transcription API (audio-to-text).

We may also disclose information if required by law, to protect our rights, prevent fraud, or protect the safety of our users.

5. International Data Transfers

The Company is headquartered in Singapore. Your data may be transferred to and processed in jurisdictions other than your own, including Singapore and the United States, where our service providers operate. We comply with the Personal Data Protection Act 2012 (PDPA) of Singapore and implement appropriate safeguards for international transfers.

6. Data Retention

• Account and User Content: Retained for the duration of your account, plus 30 days after deletion.
• Billing Records: Retained for 7 years per applicable tax and accounting regulations.
• Usage Data: Retained for 12 months.
• Audio Recordings (Lauki Sense): Processed in real-time and not stored on our servers. Local recordings are managed by you on your device.
• Error Logs: Retained for 30 days.

7. Your Rights

Subject to applicable law, you may:

1. Request access to your Personal Data.
2. Request correction of inaccurate data.
3. Request deletion of your data.
4. Request restriction of processing.
5. Request data portability.
6. Object to processing based on legitimate interests.
7. Withdraw consent at any time.
8. Lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS 1.2+ encryption for all data in transit.
• Bcrypt password hashing — we never store passwords in plaintext.
• Role-based access controls for authorised personnel only.
• Infrastructure hosted on reputable cloud platforms with industry-standard security.
• Rate limiting and abuse prevention measures.

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but strive to use commercially reasonable means to protect your data.

9. Cookies

We use a single essential cookie (session) to maintain your authenticated session. It is HTTP-only, secure, and expires after 30 days. We do not use analytics, advertising, or tracking cookies.

10. Children's Privacy

The Services are not intended for individuals under 18. We do not knowingly collect data from children under 18. If we become aware of such collection, we will delete it promptly. Contact us at [email protected] if you believe a child has provided us with Personal Data.

11. Changes to This Policy

We may update this Privacy Policy at any time. Changes are effective immediately upon posting. Your continued use of the Services constitutes acceptance. We encourage you to review this page periodically.

12. Governing Law

This Privacy Policy is governed by the laws of the Republic of Singapore. Any disputes shall be subject to the exclusive jurisdiction of the courts of Singapore.

13. Contact

Upsurge Labs Pte. Ltd.
3 Fraser Street, #04-23A DUO Tower, Singapore 189352
Email: [email protected]

14. Lauki Concierge Orders in India

For concierge orders placed and paid in India (purchases and bookings Lauki makes on your behalf), the Data Controller is Upsurge Labs LLP, Building No. 13, 2nd and 3rd Floor, ST Bed Colony, Above Kotak Mahindra Bank, 80 Feet Main Road, Koramangala 4th Block, Bengaluru, Karnataka 560034, India. We process your data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

• What we collect: your name, phone number, email, delivery address, the items or services you ask for, and order and payment records.
• Why: only to place, deliver, track, cancel, return or refund your orders, and to support you.
• Who we share it with: the retailer, service provider or courier fulfilling your order (only what they need to deliver it), and our payment partner Razorpay Software Private Limited, which processes your payment. We never see or store your full card number, CVV or UPI PIN.
• Retention: order and payment records are kept for 8 years as required under Indian tax law; other data is deleted on request once no order is open.
• Your rights: you can ask to access, correct or erase your data, or raise a grievance, by writing to [email protected]. We respond within 30 days.