Privacy
Last updated 8 October 2026
This page describes what the site actually does with information. It is written from the code that runs it, so where something is not collected, we say so plainly rather than leaving it vague.
We are not a lawyer, and this page makes no claim about any particular law. It describes behaviour, and what we have committed to.
Who is responsible
Lustoria Enterprises decides what is collected here and why. The company is established in Spain and registered at:
Cam. de Villarcampo, 718, 02006 Albacete, Spain
That is also the postal address for a written request. Our grievance officer is Claudia and the address for anything about your information is grievance@lustoriaservices.com.
The site serves people in India, and the company that runs it is in the European Union. Both of those are true at once, so this page is written to be straight with a reader in either place.
What is processed, why, and on what basis
| What is processed | Why | The basis we rely on |
|---|---|---|
| A listed business or individual's details — name, address, phone number, hours, prices, offerings, photographs | To agree the listing with them and to keep it correct | What we have agreed with the person or business listed |
| The same details, once published | To run a directory that is useful to someone looking for a service | Our legitimate interest in publishing a directory, balanced against the listed party's interest — which is why a listing is only ever created in person, with consent noted, and taken down on request |
| Reviews and reports, with the hashed address and the optional reviewer email | To publish reviews, to moderate them, and to act on reports | Our legitimate interest in running a directory where reviews are checked by a person |
| Contact-click events — which listing, which button, which page, the locality, the hashed address | To tell how much interest a listing gets and which areas are worth covering | Our legitimate interest in measuring demand |
| Staff sign-in — the session, the hashed address, the browser string | To let our own team sign in and to keep the account secure | Our contract with the member of staff |
| Email delivery — the recipient address and the message | To send a notification about a listing, a review or a report | Our legitimate interest in telling people what happened to their own content |
Where we rely on a legitimate interest, you can object. See Your rights below.
When you simply read the site
Your browser sends the usual things to reach a web server: an IP address, the page you asked for, your browser's user-agent string, and a referring page if you arrived from a link.
We do not store your IP address. Where the site needs to tell one visitor from another — to stop the same person posting fifty reviews, or to block someone abusing the report form — it stores a one-way SHA-256 hash of the address instead, shortened to 32 characters. The address itself is never written to the database and never written to a log. A hash cannot be turned back into an address by reading it. It is worth saying that the hash uses a fixed prefix rather than a secret key, so it protects against a database being read, not against someone who is determined to test every possible address.
We do not run advertising. We do run analytics: every public page loads a Google Tag Manager container, a small script that lets us measure how the site is used — which pages are visited, in what order, from what kind of device — and send that to Google's measurement tools. It runs to help us understand whether the site is working for the people who use it, and for nothing else. It loads without asking you first. The container is a shell that we configure separately, and it sets no cookie until measurement is configured inside it; when it is, the cookies it sets are the ones in the table below.
Cookies
| Cookie | Set when | What it holds | How long |
|---|---|---|---|
city |
You pick a city | The city's short name, e.g. the slug in the URL | One year |
sid |
A member of our team signs in | A random session identifier, nothing else | Until sign-out or expiry |
sid_pw |
A team member must change their password | A flag, no data | Until the password is changed |
rep_city |
A representative picks a working city | The city's short name | Until changed |
_ga |
Measurement is configured in the Google Tag Manager container | A random identifier that tells a returning browser from a new one | Up to two years |
_ga_… |
Same as above | Which visit this is and when it started | Up to two years |
sid, sid_pw and rep_city are for our own staff and are never set for an ordinary visitor. The two _ga cookies are Google's: they are set only once measurement has been configured in the container, they carry a random identifier rather than a name or an email address, and they are not an advertising identifier. If the container is empty, no _ga cookie exists.
When you tap Call or WhatsApp
Tapping the contact buttons on a listing records one row: which listing, which kind of tap (call, WhatsApp, directions or website), the page you were on, the locality if the page had one, the hashed IP, and the time. That is the whole record. It tells the business how much interest a listing gets and tells us which areas are worth covering. No phone number, no message content, and no identifier that follows you anywhere.
That row stays on our own server and is not sent to Google. The analytics described above sees the page you were on, like any other page; it does not see which listing you tapped or the hashed address.
When you write a review
A review stores the name you type, the rating, the text, the hashed IP, and the time. An email address is optional. If you give one it is used for a single purpose — telling you if your review was removed — and it is never shown on the site, never included in a listing page, and never passed to the business.
Reports about a listing or a review store the reason, anything you type in the detail box, and the hashed IP. They do not ask for your name.
If you want a review of yours removed, write to grievance@lustoriaservices.com with enough detail to find it.
Photographs
Photographs on listings are taken by our representatives. Every uploaded image is re-encoded before it is stored, and all metadata is removed in the process — including GPS coordinates, camera serial numbers and timestamps. This matters: these photographs are taken in people's homes and workplaces, and a location tag left in a file would say where someone lives. The stored file has none of it.
We do not upload or store identity documents, registration certificates or police verification letters, for anyone. See how verification works.
People we list
A listing holds a business or an individual's name, address, phone number, hours, prices, what they offer, and photographs. A representative records it in person and asks the person to confirm they are happy to be published; we note when that consent was given.
A listing also holds an internal contact email, used only to send that person a message about their own listing — approved, changes needed, suspended. It is never shown publicly.
If you are listed and want your listing changed or taken down, write to grievance@lustoriaservices.com. There is no account to log into, and you do not need one.
Who else handles the data, and where
Everything we store — listings, reviews, reports, contact-click rows, photographs — is stored and processed in India. Our company is in Spain, so that data sits outside the European Economic Area, which has no equivalence decision covering India. We say that plainly rather than leaving it to be guessed. Analytics data is the exception: it goes to Google, and where Google processes it and for how long it is kept is set out below.
These are the only companies that handle any of it on our behalf. Each one acts on our instructions and for no purpose of its own.
| Who | What they do for us | Where they run |
|---|---|---|
| Hostinger | Runs the server the site and its database sit on | Mumbai, India |
| Cloudflare R2 | Stores the photographs on listings | Mumbai, India |
| Resend | Delivers notification email | Outside India |
| Runs the Tag Manager container and the measurement behind it | Outside India |
This section is being finalised
This section is being finalised
Nothing here is sold, and nothing is shared with anyone else except where we are obliged to hand it over, or where it is necessary to deal with fraud or abuse of the site.
How long things are kept
| What | Kept for | Then |
|---|---|---|
| Contact-click events | 24 months from the tap | Deleted |
| Reviews that were removed | 12 months from removal | Deleted |
| Reports that have been dealt with | 12 months from the decision | Deleted |
| Our audit record of moderation and admin decisions | 36 months from the decision | Deleted |
A report that is still open, and a review that is still published or waiting on a decision, are kept until they are resolved.
Staff sessions and the rate-limit counters expire on their own schedule — a session when it lapses or the person signs out, a counter within a day of the window it belongs to — and are removed without anyone asking.
A listing is a different matter. When a listing is taken down it stops being published at once: it disappears from every page, every hub and the sitemap, and it is left on record as a withdrawn listing so the decision can be explained if it is questioned later. Photographs that are no longer attached to any listing are deleted from storage within a day. If you are listed and want the record itself gone rather than only unpublished, say so in writing and we will do it.
Your rights
You can ask us to:
- Give you a copy of what we hold about you.
- Correct anything that is wrong.
- Delete it.
- Restrict what we do with it while something is in dispute.
- Object to a use that rests on our legitimate interest — including publication of a listing about you, or a contact-click record.
- Hand it over in a portable form, where you gave it to us yourself.
Write to grievance@lustoriaservices.com, or to the postal address above. Tell us what you want and enough detail for us to find the record — a listing name, a review, the date. We reply within 15 days. If we cannot do what you ask, we say why.
You can also complain to a supervisory authority. For a company established where ours is, that is the Agencia Española de Protección de Datos. If you are in India, you may have remedies under Indian law as well; we are not going to tell you which, because that is not ours to say — but writing to us first is usually faster, and we would rather fix it.
Changes
When this page changes we update the date at the top. There is no mailing list to notify, because we do not keep visitors' addresses.