Privacy Policy

Leoran (“we”, “us”) operates the Leoran mobile app and leoran.in for photographers, photo and video editors, album labs, and clients booking them in India. This policy explains what personal data we collect, why, and your rights over it. It is written to align with India’s Digital Personal Data Protection Act, 2023.

Who is responsible for your data

Leoran is the data fiduciary for the account and platform data described below. Where a photographer, editor or lab uses Leoran to run their own business, they are a separate data fiduciary for the client and guest information they enter, and Leoran processes that information on their behalf.

What we collect

• Account & profile: your mobile number (for OTP sign-in), name, profile photo, city, professional role(s) and bio. Your public profile is visible to other Leoran users.
• Private account details: UPI ID, business and GST details, and your push-notification token. These are stored separately from your public profile and are visible only to you, except that a client or professional you are working with on a booking or order is shown your UPI ID so they can pay you.
• Identity verification (optional): if you verify with Aadhaar, you provide the Aadhaar Secure QR image or the e-Aadhaar PDF. It is read on our server in memory and is not stored; the PDF password is never stored. We keep only the name printed on your Aadhaar (shown in your verified badge), the last 4 digits (visible only to you), and a one-way fingerprint that stops the same Aadhaar verifying more than one account. We do not store your full Aadhaar number, photo, date of birth or address.
• Work data you create: enquiries, bookings, quotations, agreements, invoices, payment records and payment-proof screenshots, project pipeline status, catalogues, team assignments, reviews and ratings and, for clients using the Wedding Planner, guest lists, RSVPs and vendor schedules.
• Client and guest details you enter (professionals and planners): the names, phone numbers and event details of the people you manage.
• Media: portfolio photos and videos, catalogue images, client galleries, event photos, and files shared in chat.
• Messages: chat messages exchanged with other Leoran users.
• Community listings: the photos, text and prices you post in Community promotions, with your name and city. The contact number you add is not shown on the listing. It is given only to a signed-in professional who taps Call or WhatsApp on it, and we count those taps to show you your results.
• Device & technical: app version, crash reports (Firebase Crashlytics) and diagnostic logs, including failed sign-in attempts, used to keep the service secure and working.

We do not collect your contact list or precise location. If you pick a contact to fill in a phone number, only that one name and number is saved. Photos from your device are accessed only when you choose a file to upload. If you use a free account, the app’s advertising partner collects some device information to show ads; see Advertising below.

Event photo delivery and face matching

When a photographer uses QR event delivery, Leoran uses Amazon Rekognition to detect faces in the event photos and store face descriptors (numerical data, not images) in a collection for that event only. A guest who scans the event QR gives their name, phone number and consent, and takes a selfie. The selfie is compared against that event’s photos once to find the guest’s pictures and is not stored. The event’s face data and photos are deleted automatically when the event’s delivery period ends (30 days by default, at most 90). Guests can ask for their details to be removed from the event page.

Why we use it

• To create and secure your account and sign you in.
• To provide the features (bookings, quotations, payment tracking, the professional network, discovery, messaging, client galleries, event photo delivery and the Wedding Planner.
• To send notifications you would expect: a new enquiry, a quotation reply, a payment confirmation, shoot reminders, and warnings before a gallery, event or subscription expires. You can switch most of these off in the app’s notification settings.
• To run AI features you use, such as profile suggestions, quotation help and the support assistant.
• To verify identity when you request a verification badge.
• To detect abuse, automatically check chat messages and posts for prohibited content, and meet legal obligations.

Payments

Advance and installment payments between a client and a professional are made directly by UPI to the professional’s own account. Leoran does not hold, route or take a cut of that money; we only record the amount and any payment screenshot against the booking.

Leoran’s own paid services (Pro subscriptions, verification, profile boosts, client galleries, event photo delivery and AI culling) are processed by Razorpay. We receive a payment reference and status; we never see or store your full card, bank or UPI credentials.

Advertising

Free accounts may see ads in the Leoran app, on the home screen and between profiles and posts in Discover. Ads never appear in bookings, quotations, payments or chat, and Pro accounts see no Google ads. (Community promotions posted by other members are listings, not Google ads, and are shown to everyone.) The website leoran.in shows no ads.

Ads are provided by Google AdMob. To show ads and measure them, Google’s ads software in the app collects your device’s advertising ID, basic device and app information (such as model, operating-system and app version), your IP address (used to estimate your general location) and how you interact with ads. Using the advertising ID, ads may be personalised to your interests. Google processes this data under its own privacy terms.

You can reset or delete your advertising ID, or turn off ad personalisation, at any time in your phone’s settings (usually Settings → Google → Ads, or Settings → Privacy → Ads). You will still see ads, but they will no longer be based on your interests.

Who we share data with

We do not sell your personal data. We share it only with:

• Other Leoran users you interact with: your public profile with anyone browsing, and booking, job or order details with the specific people on them.
• Google Firebase (Google LLC): sign-in, database, file storage, cloud functions, push notifications and crash reporting.
• Google Gemini API: text or images sent to an AI feature or to automated content moderation. Under the API terms this is not used to train Google’s models.
• Amazon Web Services (Amazon Rekognition): face matching for event photo delivery, as described above.
• Razorpay: payments for Leoran’s own paid services.
• Google AdMob: ads shown to free accounts in the app, as described under Advertising.
• Authorities: where required by valid legal process.

How long we keep it

• Account and work data is kept while your account is active.
• If your Pro plan ends, your benefits stay until the end of the period you paid for. After that, your newest posts that fit in the free plan’s 100 MB stay visible; older ones are hidden from others for 30 days (you can still see and save them), and we remind you every day. If you renew within 30 days they come back; otherwise they and their files are permanently deleted.
• Review videos and album PDFs that editors send for approval are deleted 30 days after upload. An approved album PDF is kept while the album is being printed, then deleted after a 3-day notice.
• Client galleries and event photo sets are deleted automatically at the end of their delivery period, along with any event face data. We send a reminder 3 days before.
• If you delete your account, we delete your profile, posts, files, reviews, bookings, invoices and other account data straight away. We do not keep hidden copies. Only the payment records for Leoran’s own paid services (held by our payment provider) are kept for the period tax law requires.

Your rights

You can access, correct or delete most of your data in the app, including deleting your account from ☰ menu → Plan & account (see how to delete your account). You can also contact us to request access, correction or erasure, or to withdraw consent for optional processing. We will respond within the time limits set by law.

Under the Digital Personal Data Protection Act, 2023 you can also: ask for a summary of the personal data we hold about you and who we have shared it with; and nominate another person to exercise these rights for you if you die or become unable to. Email support@leoran.in from your registered number or email to make any of these requests.

Security

Data is encrypted in transit. Database rules restrict each record to the people who are party to it, and private details are kept apart from public profiles. Sign-in uses one-time passwords with rate limiting.

If a personal data breach happens, we will inform the Data Protection Board of India and the affected users without delay, as the DPDP Act requires, with what happened, what data was involved and what to do next.

Cookies & local storage

leoran.in has no advertising cookies and no ad scripts. We use Google Analytics (through Firebase) to count page visits and see which pages people use; it sets first-party cookies, does not identify you by name, and is not used for advertising. Browsers that block analytics simply skip it. When you sign in, your session is kept in your browser’s local storage so you stay signed in. Client gallery and event photo pages set a small cookie that remembers that you unlocked a gallery or joined an event; it is strictly necessary for those pages to work. Event guests can choose to allow browser notifications for their photos.

Children

Leoran accounts are not intended for anyone under 18. We do not knowingly collect data from children.

Changes

We will update this page and, for material changes, notify you in the app.

Contact & grievances

For any privacy question, or to reach our Grievance Officer under the Information Technology Act and the DPDP Act, email support@leoran.in.