Privacy Notice

LastBench ("we", "us") is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data described in this notice. This notice also aligns with the EU GDPR, UK GDPR, and comparable international frameworks.

• Account: email, hashed password, username, display name, avatar (optional).
• Profile: school or college, grade / stream / year, date of birth (for age verification), NSFW preference.
• Content: posts, comments, votes, community memberships, moderator actions.
• Technical: IP-derived country (hashed), session tokens, error logs.
• Analytics: page views and interactions are sent to Google Analytics 4 only after you consent. GA4 may collect device/browser info and IP-derived location.

We do not use advertising cookies or share data with ad networks.

• Delivering the service and personalising feeds — performance of contract / your consent.
• Age gating and content safety — legal obligation (DPDP §9).
• Security, fraud prevention, moderation — legitimate use under DPDP §7(i).

LastBench is intended for users 18 years and older. We do not knowingly collect data from children under 18. If we learn we have, we delete it. DPDP §9 requires verifiable parental consent for minors, and we do not yet offer that flow.

• Account data: kept while your account is active.
• Posts & comments: retained after account deletion in anonymised form for community integrity, unless you request full erasure.
• Audit logs & moderation records: 12 months, then purged.
• Deletion requests: processed within 30 days.

Under DPDP §11–13 and equivalent international law you can:

• Access a copy of your data (right to portability).
• Correct inaccurate data.
• Withdraw consent at any time.
• Erase your account and associated personal data.
• Nominate another individual in the event of death or incapacity.
• Lodge a grievance with our Grievance Officer, and escalate to the Data Protection Board of India.

All rights are exercisable from your Profile → Privacy & rights section, or by writing to the Grievance Officer.

Data at rest is encrypted (AES-256), data in transit uses TLS 1.2+. Access to production data is limited to authorised personnel. We follow controls aligned with ISO/IEC 27001 and SOC 2 (access control, audit logging, least privilege, secure SDLC). Row-Level Security is enforced at the database layer for every user-owned table.

Primary storage is on Supabase / Cloudflare infrastructure. We rely on Standard Contractual Clauses and equivalent safeguards for any cross-border processing. Where you have selected India-only residency, data is pinned to Indian regions.

• Supabase (auth, database, storage).
• Cloudflare (edge hosting, DDoS protection).
• Lovable AI Gateway (moderation & TL;DR features — content is not used to train models).
• Google Analytics 4 (usage analytics only after consent; no ad tracking).

In the unlikely event of a personal-data breach, we will notify the Data Protection Board of India and affected users without undue delay in line with DPDP §8(6) and, where applicable, GDPR Art. 33–34.

Varun Ratnakaran
Grievance Officer & Data Protection Contact
Email: grievance@lastbench.app
Response SLA: 30 days.

You may also escalate to the Data Protection Board of India — meity.gov.in.