Privacy Policy

4.1 Data You Provide Directly

We collect data you actively provide when you:

• Register an account and complete identity verification.
• Configure trusted contacts and emergency settings.
• Log health and wellness information in the cycle tracker or symptom logger.
• Submit community safety reports or danger zone ratings.
• Contact our support team.

4.2 Data Collected Automatically

When you use the App, we automatically collect:

• Device identifiers (device ID, OS type and version, App version).
• App usage patterns, feature interactions, and session data.
• Crash reports and diagnostic data to improve App performance.
• Real-time GPS location data when SOS, route planning, or location-sharing features are active.

4.3 Data from Third-Party Services

Certain features rely on third-party services that may collect data on our behalf or in conjunction with their own privacy policies:

• Google Firebase: for authentication, cloud database, and push notifications.
• Google Gemini: for AI-powered SafeChat responses and safety route analysis.
• Google Maps: for route planning, mapping, and location display.
• RevenueCat: for subscription management and in-app purchase processing.
• Apple App Store / Google Play Store: for app delivery and payment processing.

6.1 Core Safety Features

• To transmit SOS alerts, real-time GPS coordinates, and safety notifications to your pre-registered trusted contacts.
• To enable shake-triggered and manual SOS panic features, each with a built-in countdown timer allowing the user to cancel an accidental activation: • Shake-Triggered SOS: When a shake gesture meets your configured sensitivity threshold, a 10-second countdown begins before the SOS alert is dispatched. This extended window helps prevent accidental triggers from everyday movement. • Manual SOS Trigger: When you manually activate the SOS button within the App, a 3-second countdown begins before the alert is dispatched. The shorter window reflects the urgency of a deliberate manual activation.
• During either countdown, you may: • Cancel the activation by tapping the cancel option on screen to stop the SOS alert from being sent. • Skip the countdown by tapping the skip button to immediately trigger the SOS alert without waiting for the countdown to complete. If neither cancel nor skip is tapped, the SOS alert is automatically dispatched once the countdown reaches zero. Upon dispatch, trusted contacts are notified, real-time location sharing is activated, and audio/video recording begins automatically.
• To store and apply your shake sensitivity calibration preference, ensuring the shake detection feature responds accurately to the threshold you have personally configured. This value is stored locally on your device and in your account profile solely to preserve your setting across sessions and devices. It is never used for any purpose beyond calibrating your individual shake detection trigger.
• To facilitate AI-powered safe route planning and danger zone identification.
• To power the SafeChat AI assistant for safety advice and emotional support.
• To automatically record video and audio through your device's camera and microphone upon SOS activation, as evidence of your surroundings and circumstances at the time of the emergency.
• To temporarily broadcast your approximate location and SOS alert status to nearby Luraea users who have completed the App's identity registration process, during an active SOS event, where you have enabled the Nearby User Assistance feature in App settings.

6.2 Identity Verification & Account Security

• To verify your identity using government-issued ID, facial data, and OTP authentication.
• To protect against fraudulent account creation and misuse of safety features.
• To authenticate your identity when accessing sensitive account settings.

6.3 Health & Wellness Features

• To provide cycle tracking, symptom logging, and personalized health insights within the App.
• Health data is used solely within the App for your personal benefit and is never shared with third parties for commercial purposes.

6.4 App Improvement & Safety of the Community

• To analyze anonymized community safety reports to improve danger zone accuracy and route safety ratings.
• To monitor App performance, diagnose technical issues, and improve the reliability of safety features.
• To conduct security audits and protect the App against unauthorized access.

6.5 Legal & Compliance

• To comply with applicable laws, regulations, and legal obligations.
• To respond to lawful requests from government authorities, courts, or law enforcement agencies.
• To enforce our Terms and Conditions and protect the rights of Luraea and our users.

6.6 Communications

• To send you important service notifications, security alerts, and updates about the App.
• To respond to your support requests, privacy queries, and data subject requests.
• To notify you of material changes to this Privacy Policy or our Terms and Conditions.

6.7 SOS SMS Credits & Usage

Luraea's SOS SMS alerts are sent directly from the user's device using the device's native SMS functionality. As a result, each SOS SMS sent may deduct from the user's SIM card credit balance or consume SMS units from their mobile network plan, depending on their mobile carrier and plan. Luraea does not charge, manage, or have any visibility into the user's SIM card balance or mobile network charges. Any SMS costs incurred are solely between the user and their mobile network operator.

7.1 With Your Trusted Contacts

When you activate an SOS alert or enable location sharing, your real-time GPS coordinates and safety alerts are transmitted to the trusted contacts you have pre-registered in the App. You are solely responsible for the accuracy and appropriateness of the trusted contacts you designate.

7.2 With Third-Party Service Providers

We share data with third-party service providers strictly for the purpose of delivering the App's features and services. All third-party providers are bound by data processing agreements requiring them to protect your data and use it only as directed by Luraea.

7.2 (a) Nearby User Assistance - Data Sharing

When the Nearby User Assistance feature is enabled, your approximate location and SOS alert status are temporarily shared with nearby verified Luraea users for the duration of the active SOS event only. When a nearby user accepts your assistance request, their basic profile information is displayed to you solely to help you identify who is offering assistance and to facilitate your decision to accept or decline their offer of help. This does not constitute disclosure of identity documents or a guarantee of that user's character, background, or intentions. This sharing ceases automatically once the SOS event is resolved or cancelled. Data shared under this feature is never used for commercial purposes, advertising, or profiling. Helpers are independent users of the platform and not agents, employees, or representatives of Luraea or IntraVanTech Pvt Ltd.Any misuse of profile information received through the Nearby User Assistance feature, including sharing, publishing, or distributing such information outside the App, is strictly prohibited and is a violation of the Terms and Conditions. Luraea accepts no liability for any consequences arising from such misuse by the user.

7.3 SafeChat & AI Processing

SafeChat inputs may be processed on Google Gemini's infrastructure. Before transmission, inputs are anonymized to remove directly identifying information. Luraea does not store SafeChat conversation histories on its servers beyond the active session.

7.4 Legal & Regulatory Disclosure

We may disclose your personal data to government authorities, courts, law enforcement agencies, or regulators where we are required to do so by applicable law, court order, or lawful governmental request. We will, where legally permissible, notify you of such disclosure.

7.5 Emergency Disclosure

In situations where we reasonably believe that disclosure is necessary to protect your life or the life of another person, we may share relevant personal data (including location data) with emergency services or relevant authorities, even without your prior consent. Such disclosures will be limited to the minimum information necessary.

7.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a portion of IntraVanTech Pvt Ltd's business or assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you via in-app notification or email prior to any such transfer, and the acquiring entity will be required to honor this Privacy Policy.

9.1 Technical Security Measures

• End-to-End Encryption (E2EE): All SOS alerts, real-time location data, and personal communications are transmitted using end-to-end encryption, ensuring that only intended recipients can access the data.
• Encryption at Rest: All personal data stored on Luraea's servers is encrypted using AES-256 encryption.
• Encryption in Transit: All data transmitted between the App and our servers uses TLS 1.3 or higher.
• Role-Based Access Controls (RBAC): Internal access to personal data is restricted to authorized personnel on a strict need-to-know basis.
• Data Isolation: Health and biometric data are stored in isolated data environments, separate from other data categories, to prevent unauthorized cross-use.
• Regular Security Audits: Luraea conducts regular security audits, vulnerability assessments, and penetration testing to identify and remediate security weaknesses.
• SOS Recording Protection: All video and audio recordings captured during SOS events are encrypted at rest using AES-256 and in transit using TLS 1.3 or higher. Access is strictly limited to the account holder and, where legally required, to authorized law enforcement or legal authorities acting under lawful order.

9.2 Organizational Security Measures

• All employees and contractors with access to personal data are subject to confidentiality obligations and data protection training.
• Access to production data is restricted and logged.
• A Data Protection Impact Assessment (DPIA) is conducted for all high-risk processing activities, as required by Section 24 of the PDPA.

9.3 Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, Luraea will:

• Notify the Sri Lanka Data Protection Authority within the timeframe required under Section 23 of the PDPA.
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• Take immediate steps to contain, investigate, and remediate the breach.

To report a suspected security vulnerability, please contact: support@luraea.com or issues@luraea.com

9.4 Limitation of Liability for Data-Related Safety Outcomes

Luraea implements all reasonable technical and organizational measures to protect personal data. However, Luraea and IntraVanTech Pvt Ltd shall not be liable for any harm, loss, or adverse outcome arising from the failure of safety features to function as intended due to circumstances beyond Luraea's reasonable control. All risks associated with the use of SOS recording and Nearby User Assistance features are assumed by the user as described in the Terms and Conditions.

10.1 How to Delete Your Account

You may delete your Luraea account at any time directly within the App by following these steps:

• 1. Open the Luraea App and go to Settings
• 2. Tap Delete Account
• 3. Complete the short deletion survey
• 4. Once the survey is submitted, your account will be successfully deleted

Account deletion is permanent and cannot be undone.

10.2 What Happens to Your Data After Deletion

Once your account is deleted, all personal data is permanently and securely removed from our servers within 30 days, as outlined in the retention table in Section 10.3. After this 30-day window, your data cannot be recovered under any circumstances.

Anonymized data such as community safety reports may be retained indefinitely as it cannot be linked back to you.

10.3 Data Retention

Luraea retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

13.1 Teen Users (Ages 13–17)

Luraea is open to users aged 13 and above, subject to the age-specific conditions described in this Section.

Ages 13-15: Users in this age group may create an account only with verified parental or guardian consent, confirmed through the submission of a parent's or guardian's government-issued identity document during the registration process. All processing of personal data for users aged 13-15 is carried out on the basis of explicit parental consent.

Ages 16-17: Users aged 16 and above may register with their own consent, subject to the Terms and Conditions and this Privacy Policy.

Special data handling for teen users - Precise Location and Audio/Video Recording:

• Precise location data (real-time GPS coordinates) is collected from teen users solely for the purpose of activating SOS alerts and sharing location with pre-registered trusted contacts during an emergency. This data is not used for commercial profiling, advertising, or any purpose beyond core safety features.
• Audio and video recording is activated only upon SOS alert trigger. Teen users (and, for ages 13–15, their parent/guardian) are informed of this feature at the point of registration and must provide explicit consent before the feature is enabled.

Parents or guardians of users aged 13-15 may review, withdraw consent for, or request deletion of their child's data at any time by contacting support@luraea.com.

16.1 SafeChat AI Assistant

• SafeChat is powered by Google Gemini AI infrastructure.
• Inputs submitted to SafeChat are anonymized before transmission to Gemini's servers to remove directly identifying information.
• Luraea does not permanently store SafeChat conversation transcripts on its own servers beyond the active session.
• SafeChat is not a licensed mental health professional or emergency service. Do not share sensitive personal identifying information in SafeChat.
• SafeChat responses are AI-generated and may not always be accurate. Always contact official emergency services in a genuine emergency.

16.2 AI Route Planning & Danger Zone Analysis

• AI route safety ratings and danger zone assessments are generated from anonymized community reports and AI analysis.
• Your location data used for route planning is not retained beyond the active session.
• Route and danger zone data is not shared with any commercial third parties.

16.3 Nearby User Assistance Feature - Data Handling

When this opt-in feature is enabled, your approximate GPS location and SOS alert status are temporarily broadcast to nearby Luraea users who have completed the App's identity registration process, for the duration of the active SOS event only. When a nearby user accepts your assistance request, their basic profile information is displayed to you solely to help you identify who is offering assistance and to facilitate your decision to accept or decline their offer of help. This does not constitute disclosure of identity documents or a guarantee of that user's character, background, or intentions.

• Location data shared with nearby users is approximate and is not retained by Luraea beyond the active SOS event.
• Your basic profile information may be partially visible to a responding user solely to facilitate the assistance interaction.
• Data processed under this feature is never used for commercial purposes, advertising, or profiling.
• This feature is opt-in and disabled by default. You may enable or disable it at any time through App settings.
• Luraea does not retain records of which nearby users viewed your SOS alert unless they actively accepted the assistance request.
• Nearby users who respond to your alert are independent platform users and are not agents or representatives of IntraVanTech Pvt Ltd. Luraea accepts no liability for their conduct or actions.

16.4 SOS Video and Audio Recording - Data Handling

When an SOS alert is activated, the App automatically initiates video and audio recording through your device's camera and microphone. The following data handling practices apply:

• Recordings are encrypted at rest using AES-256 and in transit using TLS 1.3 or higher.
• Access is strictly limited to you and, where legally required, to authorized law enforcement or legal authorities acting under lawful order.
• Recordings are retained for the duration of the active account and are permanently deleted within 30 days of account deletion, unless earlier deletion is requested or retention is required by applicable law or an active legal proceeding.
• Recordings are never sold, shared with advertisers, used for AI training, or used for any commercial purpose.
• You may manually stop the recording at any time during an active SOS event using the stop control within the App interface.
• To request early deletion, contact support@luraea.com with the subject line "SOS Recording Deletion Request."
• SOS recordings may be disclosed to law enforcement or legal authorities only under a lawful court order, warrant, or legal obligation. Luraea will not voluntarily disclose recordings to any third party outside the circumstances described in Section 7.