Privacy policy

Effective 29 October 2026. Labbaik360 Connect is operated by the owner of Labbaik360 Connect.

In short:

Your messages, voice and photos stay mainly on your phone. The server passes them on and then deletes them, unless your plan or organisation turns on server history.
One-to-one talk, texts, photos and locations are end-to-end encrypted, except during a complaint review described below.
Your phone number and email are never shown to other users.
We do not sell your personal data.

This policy explains how the owner of Labbaik360 Connect ("we", "us") processes personal data when you use Labbaik360 Connect (the "Service"). For the Digital Personal Data Protection Act, 2023 of India ("DPDP Act"), we are the Data Fiduciary. For the Personal Data Protection Law of the Kingdom of Saudi Arabia ("PDPL"), and for the EU and UK GDPR where they apply, we are the controller. When an organisation (for example your tour operator or employer) manages your account, that organisation decides some of the processing, and it may also be responsible for it.

1. What we collect

Data	What it is	Where it comes from
Account	Mobile number and/or email, name, username, password (stored only as a one-way hash), sign-in codes (stored hashed, briefly), Google account id if you use Google sign-in	You
Profile	Photo, about line, status, privacy choices, online and last-seen time	You, your app
Contacts and groups	People you add, requests, blocks, groups and channels you belong to	You, your organisation
Messages	Voice clips, texts, photos, locations, alerts and SOS you send or receive	You and the people you talk with
Device	Phone model, operating system, app version, a device identifier, push token, battery level, network type, and the public key used for encryption	Your app
Location	Position when you share it. If your organisation turns it on, your position at intervals while the app runs, so your group leader can see it	Your app, with your permission
Proof of agreement	That you confirmed you are 18 or older and accepted the Terms and this Policy: the version, date and time, and the IP address used	Our servers, kept as long as your account exists and for the period the law requires after
Usage and diagnostics	Screens opened, features used, talk time, errors, IP address, sign-in times. Optional Google Analytics if your organisation turns it on	Your app, our servers
Safety	Reports you make or that are made about you, the messages a reporter chooses to attach, limits, and review records	You, other users, our staff

Added on 8 November 2026

Ads. Free accounts may see ads. Where the law asks, you choose your ad privacy settings first, and you can change them under Settings, Ad privacy choices. Ad partners reached through Google AdMob (such as AppLovin, Unity and Meta) may use your advertising id and device data under their own policies. Mature ads are turned off.

Local offers. Off unless you turn on "Local offers near me" in Settings. Your phone then sends a rough position (about 1 km) to choose offers for your area. We use it for that answer and do not store it. Location you share for group safety is not used for ads.

Paid plans. Google Play handles your payment; we do not receive your card or bank details. We keep the purchase reference, your plan and its end date. Payments outside Google Play, where offered, are made in your UPI app, and we keep the payment reference you send us.

Crash and debug reports. If the app crashes, it sends us the technical error, app version, phone model and Android version, linked to your account, so we can fix it. A debug report is sent only when you choose, with your note and the app's recent technical log. These never include your messages or voice. Kept until replaced by newer reports.

Your own chat backup. If you turn it on, your chats and media are copied to a hidden folder in your own Google Drive, locked with a password only you know. We cannot read the backup and cannot recover it if you forget the password. Disconnecting or deleting it is in your control.

We do not collect your phone's address book, call logs or SMS messages.

2. Where your messages are kept

On your phone. Your history is saved on your phone. Uninstalling the app or using "clear history" removes it.
On our server, briefly. Each message is held only until the people it is for have received it, and then for at most the relay period. The relay period is 72 hours unless your organisation sets another. After that it is deleted.
On our server, as history. Only if your plan or organisation turns on server history. In that case messages are kept for the history period (30 days by default). SOS alerts are always kept for the history period, for safety.
Encryption. One-to-one voice, texts, photos and locations are end-to-end encrypted when both phones support it, so our server cannot read them. Channel and group messages are encrypted in transit and at rest on our server, but are not end-to-end encrypted.

3. Complaint reviews (investigations)

When a user complains about an account (for example spam, fraud, harassment or threats), or when the law requires it, an authorised member of our staff may open a review of that account. During a review:

end-to-end encryption is paused for that account's new one-to-one talk and messages, in both directions;
what the account sends and receives is kept on our server;
authorised staff may read and listen to it, together with the account's activity records (sign-ins, devices, contact requests and reports).

Messages sent earlier with end-to-end encryption remain unreadable to us.

A review needs a written reason and lasts at most 30 days unless renewed for cause. Every opening, view and playback is logged. When the review ends, the collected data is deleted or, where needed for legal claims or a report to authorities, kept as evidence for as long as required.

We do this for the legitimate uses the DPDP Act allows, which include complying with law and preventing fraud and harm. Under the PDPL and GDPR we rely on our legitimate interest in keeping users safe, and on legal obligations. To protect investigations, we do not normally tell the person under review while it is under way.

4. Why we use your data

To provide the Service: sign-in, delivering talk and messages, contacts, groups, profiles, location features, SOS and notifications.
To keep the Service safe: preventing spam, fraud and abuse, enforcing our Terms, handling reports, and the reviews described above.
To run and improve it: fixing problems, measuring use, planning capacity, and backups.
To show ads, where your plan includes them. Ad partners may use your device's advertising id under their own policies. You can reset or limit it in your phone settings.
To meet legal duties: responding to lawful requests, keeping required records, and handling grievances.

Legal bases:

your consent, which you give when you sign up and grant permissions;
legitimate uses under section 7 of the DPDP Act;
performance of our contract with you;
legal obligations;
our legitimate interests, where the PDPL or GDPR allow them.

You can withdraw consent at any time. This does not affect processing already done, and some features may stop working.

5. Who we share data with

We do not sell personal data. We share it only with:

the people you talk with, and in the way your privacy settings allow (your phone number and email are never shown to other users);
your organisation's administrators, if an organisation manages your account;
service providers who process data for us under contract and only on our instructions:
- cloud hosting (Amazon Web Services);
- SMS, WhatsApp and email delivery of sign-in codes (for example MSG91, or our own mail server);
- Google, for Google sign-in, Firebase notifications, optional Google Analytics and optional Google Drive backups;
- ad networks such as Google AdMob;
authorities, when the law requires it: courts, law enforcement or government agencies acting under a valid legal process, including under the IT Act and Rules, or to protect someone's life or safety;
a buyer or successor, if our business is reorganised or sold, under the same protections.

6. Where data is stored and transferred

Our main servers are in India. Some providers listed above may process data in other countries.

India. Transfers outside India follow the DPDP Act and any restrictions the Government notifies.
Saudi Arabia. For users there, transfers outside the Kingdom follow the PDPL and its Regulations on Personal Data Transfer outside the Kingdom.
EU and UK. For users there, transfers use adequacy decisions or standard contractual clauses.

7. How long we keep it

Data	Kept
Account and profile	While your account exists, then deleted within 30 days of deletion
Messages on the server	The relay period (72 hours by default), or, where server history is on, the history period (30 days by default)
SOS alerts	The history period (30 days by default)
Location history	The period your organisation sets, by default 30 days
Usage analytics	90 days by default
Reports, review records and the security log	Up to 3 years, or longer if needed for legal claims
Backups	Encrypted, kept for up to 14 copies, then overwritten

We may keep data longer where the law requires it. Logs kept under directions from the Indian Computer Emergency Response Team (CERT-In) are kept for 180 days.

8. Security

We use encryption in transit (HTTPS/TLS), end-to-end encryption for one-to-one content, encryption at rest for stored files and messages, and encrypted backups.
Staff access is limited by role. Moderators cannot see phone numbers, emails or locations, and staff access is logged.
We use rate limits and lock out repeated wrong passwords.

No system is perfectly secure. If a breach affects you, we will notify you and the authorities as the law requires: the Data Protection Board of India and CERT-In in India, the Saudi Data and AI Authority (SDAIA) in the Kingdom, and the relevant supervisory authority under the GDPR.

9. Your rights

Depending on where you live, you can:

get a summary of your personal data and how it is processed (DPDP Act s.11), or a copy of it (PDPL, GDPR);
correct, complete or update it (s.12);
delete it and your account (s.12). You can do this in the app or as described on this page;
withdraw consent (s.6), and object to or restrict some processing (GDPR);
nominate someone to exercise your rights if you die or become incapable (s.14);
have a grievance handled by our grievance officer (s.13). If you are not satisfied, you can complain to:
- the Data Protection Board of India;
- SDAIA in the Kingdom of Saudi Arabia;
- your local data protection authority.

To use these rights, write to our grievance officer below. We may need to confirm your identity first.

Your privacy controls in the app are under Settings and My profile:

who can find you;
who can send you requests;
who sees your photo and about line;
hiding your online status and last seen;
blocking people.

10. Children

The Service is for people aged 18 and over. We do not knowingly process children's personal data or track or target ads at children. If we learn that a child is using the Service without verifiable parental consent, we will delete the account.

11. Phone permissions

The app asks for:

the microphone, to talk;
notifications, for alerts;
location, for location sharing, SOS and, if your organisation uses it, live location;
the camera and photos, for profile pictures and sending photos;
Bluetooth and nearby devices, for headsets and offline features;
running in the background, so messages reach you when the screen is off.

You can change permissions in your phone settings at any time.

12. Changes

We may update this policy. If a change is material, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.

Contact and grievance officer

Questions, complaints or requests about these terms or your data:

Grievance officer: Grievance Officer
In the app: Settings, then Legal and help

We acknowledge complaints within 24 hours and resolve them within 15 days, or sooner where the law requires (for example 72 hours for requests to remove certain unlawful content, and 24 hours for content showing a person's private areas or impersonating them).