Privacy Policy

We only collect the absolute minimum data required to deliver reliable APIs, maintain account security, and provide technical support:

• Account & Authentication Information: When you register for the developer console or subscribe to an API tier, we store your email address, full name, encrypted password hash (via Bcrypt/Argon2), and account creation timestamps in our protected cloud database.
• API Usage & Diagnostic Telemetry: To enforce rate limits, detect denial-of-service attempts, and calculate quota usage, our gateway logs metadata including API key IDs, HTTP request methods, endpoint paths, response status codes, and latency figures. Request bodies and sensitive payloads are discarded from operational access logs.
• Support & Inquiry Communications: When you submit support tickets or partnership requests via our contact portal or direct email, we retain your message history, phone number (if provided), and correspondence to resolve technical issues efficiently.

We have architected all online tools in the Lushai Dev Utility Suite—such as the Bcrypt Password Hasher, WebP Image Converter, API Key Generator, JSON Formatter, and HTML Runner—to execute 100% locally inside your web browser:

Every byte of network traffic between your client applications and Lushai Dev endpoints is secured with TLS 1.3 protocol encryption. We employ strict Content Security Policies (CSP), HTTP Strict Transport Security (HSTS), and CORS constraints to protect against packet interception, man-in-the-middle attacks, and unauthorized origin requests.

API secret keys issued to developers are stored as one-way cryptographic hashes. If an API token is lost, it cannot be recovered in plaintext by any administrator; a replacement key must be generated through the developer console.

For merchant payment products such as PhonePey (UPIGateway.dev):

• Non-Custodial Settlement: Lushai Dev never holds customer funds in escrow or custodial accounts. Payments initiated via NPCI dynamic QR codes route directly to the merchant bank account linked with their Virtual Payment Address (VPA).
• Verification Metadata: Our system receives automated bank transaction UTR numbers and settlement webhooks solely to verify order completion status and trigger customer notification callbacks.

Our WAPI automation gateway enables businesses to transmit transactional notifications, OTP codes, order confirmations, and customer support messages. We strictly forbid the use of WAPI for bulk spamming, phishing, unsolicited advertising, or violations of WhatsApp Business policies. Automated anti-abuse filters and throttling prevent gateway abuse.

We retain operational logs for a maximum of 30 days for debugging and abuse mitigation, after which they are permanently purged. Account records remain active while your developer account is in good standing.

You have the right to request a full copy of all data associated with your account, or request complete account erasure at any time. When an account is terminated, all associated API credentials, webhook endpoints, and personal identifiers are immediately removed from production databases.

For privacy inquiries, data deletion requests, or technical security reports, reach our independent developer desk directly: