Privacy Policy

This Privacy Policy explains how Osalution LLC, operator of the Laloke product, handles information through the Laloke website, marketplace, and supporting services. It does not replace notices supplied directly by independent providers such as Stripe.

Laloke is intended for adults. You must be at least 18 years old to create an account, book a session, or list as a Host. Laloke does not knowingly collect personal information from anyone under 18, and it does not knowingly collect personal information from a child under 13. If Laloke learns that it holds information from a person under the stated age, it removes that information. If the service later opens to minors, this Policy and the related settings change first.

We handle account and profile details such as email, display name, role, Host type, and password-derived security records. Hosts provide location, address, coordinates, availability, capacity, amenities, equipment, prices, listing media, and private verification media. Users may submit booking details, ratings, messages, reports, cancellation reasons, and support communications.

Laloke stores one-way password hashes, hashed refresh and password-reset tokens, encrypted authenticator secrets for Hosts and administrators, session and security-setup state, suspension state, and security audit records. The browser keeps a short-lived access token in memory or session storage, a non-secret session hint, and functional cart or preference data. The refresh token is placed in an HttpOnly cookie.

We process session and equipment windows, selected equipment, itinerary, status, canonical times, timezone offset, cancellation and rating eligibility, and integer-cent price, fee, earnings, refund, and settlement records needed to operate bookings.

Stripe hosts card entry and payment processing. Laloke does not intentionally receive or store card PAN or CVC. We do store payment and connected-account identifiers, status, amount, fee, transfer, refund, and reconciliation information needed to create Checkout, confirm payment, pay Hosts, resolve failures, and provide support.

If you choose current-location discovery, your browser asks permission and provides coordinates used to center marketplace search. Laloke does not claim to continuously track your device location. When you submit destination text, the server sends the query to Geoapify for geocoding. The service logs a hash rather than the raw destination query in its application event, and resolved coordinates and a display label can appear in shareable Browse URL state. Safety Alert relies on the facility location tied to your booking. It does not use your device’s live location.

Listing media may be public when an eligible listing is published. Host verification media remains private and is exposed only through authorized, time-limited reads. Booking participants and authorized operators can access applicable messages.

Ratings, reports, blocks, moderation state, and read state are processed to operate marketplace communication, reputation, and safety features.

We process request and route information, canonical network identity, record and provider identifiers, timestamps, error and transition context, availability and performance metrics, audit events, and aggregated marketplace analytics. Logs are intended to exclude passwords, raw tokens, authenticator seeds, reset links, signed media URLs, and private message bodies. Infrastructure providers may maintain separate access and security logs.

Information is used to provide accounts, discovery, listings, bookings, payments, payouts, messages, ratings, support, moderation, fraud and security controls, availability and capacity enforcement, service analytics, provider reconciliation, legal compliance, and platform maintenance.

We disclose information to the Customer, Host, or authorized operator as required for their role and booking relationship; to service providers that process it for Laloke; when reasonably necessary to protect users, enforce the service, or investigate misuse; and when required by law. Public listing fields are deliberately allowlisted and exclude Host security, billing, moderation, and private verification data.

Current provider categories include Stripe for payments and connected-account onboarding; Render for application and PostgreSQL hosting; AWS S3 for configured media-object storage; and Geoapify, using OpenStreetMap-derived data, for production destination and address geocoding. Email delivery and other infrastructure providers may receive the limited data needed for configured delivery or operations. Each provider handles personal data under a contract that limits its use to services performed for Laloke. If Laloke engages a background-check provider, that provider receives only the data needed for the check and acts under the same kind of contract.

Laloke retains records for the operational, security, dispute, transaction, and legal purposes for which they are needed. Database backups and provider copies can have separate lifecycles. Laloke does not currently publish a comprehensive fixed retention schedule or offer instant self-service account deletion. Contact support for an account, privacy, access, correction, or deletion request; the response will depend on applicable law and records that must be retained. Send access, correction, and deletion requests to support@laloke.app, and Laloke responds within the period applicable law requires and describes the action taken. A deletion request removes or de-identifies your personal and account information where Laloke is required to act. It does not erase completed transaction history. Laloke keeps records of past bookings, payments, earnings, settlements, refunds, tax records, and reconciliation, and it keeps de-identified aggregate marketplace analytics, where it has a lawful reason to retain them. Deleting a Customer account does not reduce a Host’s historical earnings, completed booking counts, or settlement records.

Laloke uses role and ownership checks, explicit response allowlists, password hashing, encrypted authenticator material, protected refresh cookies, signed browser-to-API identity, provider verification, upload validation, and operational audit records. No online service can guarantee absolute security, and these controls are not a third-party compliance certification.

You can ask Laloke to give you access to the personal information it holds about you, to correct information that is wrong, and to delete your account and associated records. To make a request, contact support@laloke.app. Laloke verifies the request against your account and responds within the period applicable law requires. Laloke keeps records where a law, an open transaction, a dispute, or a security need requires it, and it tells you when that applies to your request.

Your privacy rights depend on where you live and on whether Laloke meets the threshold set by your state. Where a state law applies, you may have the right to confirm whether Laloke processes your personal information, to access or correct it, to request deletion, to receive a portable copy, and to opt out of targeted advertising, the sale of personal information, or certain profiling. To exercise a state right, contact support@laloke.app and name the state where you live. Laloke applies the process that the state law requires, including any appeal step.

Laloke does not sell your personal information for money, and it does not use your personal information for cross-context targeted advertising. Laloke shares personal information only with the providers and parties described in this Policy. If Laloke adopts a sale, a sharing-for-advertising, or a targeted-advertising practice, it updates this Policy and provides the opt-out that applicable law requires before doing so.

You can decline browser geolocation and search by destination instead. You can manage certain account and listing information through the product and can contact support about account or privacy requests. Browser controls can limit cookies or storage, but blocking strictly functional session data may prevent sign-in or Checkout from working.

The current version and effective date appear above. Material revisions use a new version, and authenticated users may be asked to acknowledge the current Privacy Policy before normal marketplace activity. Questions or requests can be sent to support@laloke.app. Jurisdiction-specific retention, privacy-rights, and regulatory wording should receive external legal review before broad public launch.