Upload Pricing Sign in Sign up

Privacy Policy

Effective date: 14 November 2026. This Privacy Policy supersedes and replaces in its entirety the Privacy Policies of Lensdump effective 13 November 2026, 10 November 2026 and 20 October 2026, the privacy policy of Lensdump dated 25 June 2023 and every earlier version, which are withdrawn and cease to apply from the effective date.

This Policy constitutes the notice required under section 5 of the Digital Personal Data Protection Act, 2023, and describes, in a clear and plain manner, the personal data that Lensdump processes, the purposes and manner of such processing, the rights available to you and the means by which you may exercise them. It is to be read together with, and forms part of, the Terms of Service.

Contents · 24 sections
1. Scope and application2. Definitions3. The Data Fiduciary4. Personal data we collect5. Sources of personal data6. Purposes of processing7. Grounds of processing and consent8. Information visible to others9. Disclosure to Data Processors and third parties10. Transfer of personal data outside India11. Retention and erasure12. Security safeguards and breach notification13. Cookies and similar technologies14. Marketing communications15. Measurement of advertising16. Your rights as a Data Principal17. Your duties as a Data Principal18. Children19. Aggregated and anonymised data20. Corporate transactions21. Third-party websites and services22. Changes to this Policy23. Grievance Officer and the Data Protection Board24. Contact

1.1 This Policy applies to all personal data processed by Lensdump in connection with the website lensdump.com, its sub-domains and file domains (including l3n.co), and every product, feature and service offered through them (the "Service"), whether you are a registered Member or a visitor. It applies irrespective of the device or means by which you access the Service.

1.2 By accessing or using the Service, you acknowledge that you have read and understood this Policy. Where processing is based on your consent, that consent is sought separately, by a clear affirmative action, and may be withdrawn in accordance with clause 7.

2.1 In this Policy, unless the context otherwise requires: (a) "Act" means the Digital Personal Data Protection Act, 2023 and the rules made thereunder; (b) "personal data" means any data about an individual who is identifiable by or in relation to such data; (c) "processing" means any wholly or partly automated operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, restriction, erasure or destruction; (d) "Data Principal", "you" and "your" mean the individual to whom the personal data relates; (e) "Data Fiduciary", "Lensdump", "we", "us" and "our" mean Lensdump Private Limited; (f) "Data Processor" means any person who processes personal data on behalf of Lensdump; and (g) other capitalised terms have the meanings given to them in the Terms of Service or the Act.

3.1 The Data Fiduciary responsible for your personal data is Lensdump Private Limited, a company incorporated under the Companies Act, 2013 (CIN U63120BR2026PTC083813), having its registered office at Road Number 9, Rajeev Nagar, Keshri Nagar, Patna, Bihar 800024, India. Lensdump determines the purposes and means of the processing described in this Policy.

4.1 Lensdump collects only such personal data as is necessary for the purposes described in clause 6. Depending on how you use the Service, this may comprise the following categories:

  • Account and identity data: username, email address, name, and password, which is stored only in the form of a one-way cryptographic hash and is never stored or retrievable in readable form; together with any profile picture, cover image, biography and website that you choose to provide.
  • User Content and associated data: the images, videos and other files that you upload, their titles and descriptions, albums, tags, likes and follows. Where you elect to retain EXIF data, your files retain embedded metadata, which may include camera particulars and the geographical location at which a photograph was taken.
  • Billing and transaction data: the name, state and country to be shown on invoices; where provided, your postal address and the GSTIN and legal name of your business; and, as received from our Payment Processor, the amount, currency, date, status and reference numbers of each payment and the means of payment (the card network and the last four digits of a card, or the UPI identifier). Lensdump does not receive or store complete card numbers or card security codes.
  • Technical and usage data: Internet Protocol (IP) addresses and, where made available by our network provider, the source port of the connection, recorded when you register an Account, sign in, upload a file, create an album, submit a message or record an email consent; the browser and operating system indicated by your browser's user agent, and, for each file you upload, the browser or app details (user agent) sent with the upload; the country from which you connect, as determined by our network provider; the network (autonomous system) and the range of IP addresses (a /24 range for IPv4, a /48 range for IPv6) from which each page of the Service is requested, without the complete IP address; information about signed-in sessions and devices; and web server, diagnostic and security logs.
  • Communications data: the content of messages you submit through the contact page or by email, together with the IP address, browser and page from which a message was sent.
  • Consent and preference data: your settings and email preferences, and, for each email list, a record of your consent, comprising the wording to which you agreed, the date and time and the IP address from which consent was given or withdrawn; and, where you consent to the measurement of an advertisement under clause 15.5, a record of that consent kept with the record of the click, comprising the version of the notice to which you agreed and the date and time, but not your IP address.
  • Email interaction data: whether links contained in newsletters and offers sent by Lensdump are clicked. Lensdump does not use tracking pixels or similar means to determine whether an email has been opened.
  • Connected account data: where you sign in with or connect a Discord, Google or Facebook account, the identifier and display name made available by that service, including, in the case of Discord, your Discord user identifier.
  • Advertising data: where you arrive at the Service by clicking an advertisement of Lensdump displayed by Google, the identifier that Google assigns to that click, together with the page at which you arrived, the advertising campaign and the country from which you connect, and, where you then register an Account, a record kept with your Account that it was registered after that click, as described in clause 15.

4.2 Lensdump does not intentionally collect sensitive personal data, such as data concerning health, religion or sexual orientation, other than as may be contained in User Content that you choose to upload, for which you are responsible under the Terms of Service.

5.1 Personal data is obtained (a) directly from you, when you register, complete your profile, upload User Content, make a purchase, change your settings or contact us; (b) automatically, through your use of the Service, by means of server logs, cookies and similar technologies; and (c) from third parties, namely our Payment Processor in respect of transactions, and the sign-in services you choose to connect.

6.1 Lensdump processes personal data for the following specified purposes:

  • to create and administer Accounts, authenticate Members, and provide, operate and maintain the Service, including the storage, display and sharing of User Content in accordance with your privacy settings and the enforcement of Plan limits;
  • to process payments, administer Memberships, renewals, upgrades, offers and refunds, and to issue tax invoices and credit notes;
  • to comply with obligations under the Goods and Services Tax laws, the Income-tax Act, the Companies Act, 2013 and other Applicable Law, including the maintenance of books of account and the filing of returns;
  • to secure the Service and its Users, to detect, investigate and prevent fraud, abuse, unauthorised access and breaches of the Terms of Service (including by comparing the origin of a payment with its currency), and to provide sign-in alerts and a list of signed-in devices;
  • to detect, measure and prevent automated access to the Service, including scraping, mass downloading and denial-of-service activity, and to block the networks and ranges of IP addresses from which such activity originates;
  • to review, moderate and act upon User Content and complaints, and to respond to the Grievance Officer's complaints process;
  • to detect known child sexual abuse material, by comparing a fingerprint of each uploaded picture and of frames of each uploaded video (a short numerical summary computed on our servers, not the picture itself) with a list of known material, and to report such material as the law requires;
  • to send account, billing, security and legal communications, which are integral to the Service;
  • with your consent, to send newsletters, offers and product updates;
  • to measure the effectiveness of Lensdump's own advertising, by reporting to Google the first purchase made through an Account registered after a click on an advertisement of Lensdump, and by counting the Accounts so registered and the payments made for them, as described in clause 15;
  • to measure and analyse the use of the Service through our own records of the pages visited, described in clause 11.1, which hold no IP address and no Account, in order to maintain and improve it;
  • to determine the currency in which prices are offered to you;
  • to preserve the records relating to User Content that is reported or suspected to be unlawful, in particular child sexual abuse material, and to report it and furnish information to competent authorities as required by the Protection of Children from Sexual Offences Act, 2012 and the rules made thereunder, the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the directions issued by the Indian Computer Emergency Response Team under section 70B of the Information Technology Act, 2000;
  • to respond to lawful requests and orders of courts, law enforcement agencies and other competent authorities, and to establish, exercise or defend legal claims.

6.2 Lensdump shall not process personal data for any purpose incompatible with the purposes stated above without informing you and, where required, obtaining your consent.

7.1 Lensdump processes personal data (a) on the basis of your consent, given by a clear affirmative action, in respect of marketing communications and, where clause 15.5 applies, the measurement of advertising; and (b) for the legitimate uses recognised under section 7 of the Act, including where you have voluntarily provided personal data for a specified purpose, for the performance of any function under any law, and for compliance with any judgment, order or legal obligation.

7.2 You may withdraw any consent at any time, with the same ease with which it was given, including through the email preferences in your Account settings, the unsubscribe link in each marketing email or, in respect of the measurement of advertising, the means described in clause 15.7. Withdrawal shall not affect the lawfulness of processing carried out before it, and Lensdump shall, within a reasonable time, cease and cause its Data Processors to cease processing the relevant personal data, save where processing is otherwise permitted or required by law.

8.1 Your public profile, your public albums and the files within them, and your username, name, profile picture and biography may be viewed by any person. The visibility of each album and its files is determined by the privacy setting you select. Where you elect a private profile, your profile page and your name on your files are hidden from others, but the visibility of files continues to be governed by the privacy setting of each album.

8.2 Your email address, billing data, IP addresses and payment details are not displayed to other Users. Information that you make public may be viewed, copied and redistributed by others beyond the control of Lensdump.

9.1 Lensdump does not sell personal data, and does not share it with advertisers or for the advertising of any other person. Lensdump discloses personal data only to the following categories of recipients, to the extent necessary for the stated purpose and, in the case of Data Processors, under contracts or terms that require them to process it only on Lensdump's instructions or for the provision of their services:

  • Razorpay, as Payment Processor, for the processing of payments by card, UPI and e-mandate;
  • Cloudflare, for the delivery of the Service and its protection against attacks, through whose network your traffic passes, and whose CSAM Scanning Tool compares the fingerprints of pictures served through its network with lists of known child sexual abuse material;
  • Scaleway, for the delivery of account and security emails, and Mailtrap, for the delivery of newsletters and offers to persons who have consented to receive them;
  • Google, for sign-in where you elect to sign in with Google, and, as described in clause 15, to measure the effectiveness of Lensdump's own advertising on Google;
  • Discord and Facebook, for sign-in where you elect to use them, and, in the case of Discord, for the assignment of your role on the Lensdump Discord server;
  • the Canadian Centre for Child Protection (Shield by Project Arachnid), which receives only the fingerprints of uploaded pictures and video frames, never the pictures or any account data, to check them against its list of known child sexual abuse material;
  • Lensdump's chartered accountants and professional advisers, for the purposes of tax compliance, audit and legal advice, under duties of confidentiality;
  • courts, law enforcement agencies, regulators and other competent authorities, including through the National Cybercrime Reporting Portal, where disclosure is required by law or legal process, or is necessary to protect the life, safety or rights of any person.

10.1 Personal data is stored on servers located in the European Union, the United States of America and India, and certain Data Processors process personal data outside India. Any such transfer is made in accordance with section 16 of the Act and shall not be made to any country or territory to which transfer has been restricted by the Central Government by notification. Lensdump requires that personal data so transferred continue to be protected in a manner consistent with this Policy.

11.1 Lensdump retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by law, and in particular:

  • Account data and User Content, for as long as the Account exists, and thereafter in backups for a limited period, after which it is deleted in the ordinary course; a file you delete can be restored by you from Recently deleted for thirty (30) days, and its stored copies may remain on our storage and in backups for a further period until they are removed in the ordinary course;
  • invoices, credit notes, payment and billing records, for the period prescribed by the tax and company laws of India (presently not less than eight years from the end of the relevant financial year in respect of books of account), notwithstanding the deletion of the Account;
  • consent records, for as long as the consent applies and for such further period as may be required to demonstrate that consent was obtained;
  • messages sent through the contact page or by email, for one (1) year from their receipt;
  • the User Content of an Account that has been banned, for thirty (30) days from the ban, after which it may be permanently deleted;
  • records of the pages of the Service that were visited (the kind of page, the referring website, the country, the type of device and a hash of the device id, without any IP address or Account), for ninety (90) days, after which only anonymous daily totals are kept; and the record that a Member used the Service on a given day, for four hundred (400) days;
  • the records of networks and ranges of IP addresses described in clause 4.1, for fourteen (14) days;
  • the record of a click on an advertisement of Lensdump described in clause 15.1, with the identifier of the click, for ninety (90) days from the click, whether or not a purchase has been reported;
  • the record that an Account was registered after a click on an advertisement of Lensdump described in clause 15.6, which does not contain the identifier of the click, for as long as the Account exists or, where the click was recorded with your consent under clause 15.5, until you withdraw that consent;
  • the IP address recorded with an uploaded file, for as long as the file exists and for one (1) year after its deletion; and the source port and user agent recorded with it, until the file is deleted for good;
  • records of sign-ins, attempted sign-ins, registrations, password resets and two-factor verifications, including the IP address from which each was made and, for a sign-in, its source port, for one hundred and eighty (180) days;
  • the record of a signed-in device, with the IP address and browser from which it signed in, for as long as it remains signed in and for one (1) year after it was last used;
  • web server logs, comprising the IP address, the source port where available, the address requested, the date and time, the response, the referring address and the user agent, for one hundred and eighty (180) days;
  • User Content removed by Lensdump for a breach of the Terms of Service or of Applicable Law, or upon an order of a competent authority, together with the records associated with it, for one hundred and eighty (180) days from its removal, during which it is not accessible to Users;
  • records of actions taken by Lensdump's staff, permanently, as an audit trail;
  • other logs and security records, for such period as is necessary for the security and operation of the Service, or for such longer period as Applicable Law may require.

11.2 Upon the expiry of the applicable period, or upon the withdrawal of consent or a valid request for erasure (where retention is not otherwise required by law), Lensdump shall erase the personal data and cause its Data Processors to do so, within a reasonable time.

11.3 Notwithstanding clauses 11.1 and 11.2 and any request for erasure, where Lensdump places an Account under a legal hold, in particular upon confirming child sexual abuse material or upon an order, direction or request of a court or other competent authority, the User Content of the Account and the personal data associated with it are not deleted while the hold remains in place; and a copy of the records identifying the Member, made when the hold is placed (including the IP addresses, source ports and user agents recorded with User Content, and the records of sign-ins and signed-in devices), is kept until one hundred and eighty (180) days after the hold is released, or for such longer period as an investigation, proceedings or Applicable Law may require. Such data is used only for that purpose and is made available only to the competent authorities and to persons entitled to it by law.

12.1 Lensdump implements reasonable security safeguards, as required by section 8(5) of the Act, to protect personal data against breach, including encryption of data in transit, storage of passwords only as one-way hashes, access to files in private or password-protected albums only through links signed for authorised persons, restriction of internal access to those who require it, and the optional use of two-factor authentication and remote sign-out by Members.

12.2 No method of transmission or storage is completely secure, and Lensdump cannot guarantee absolute security. In the event of a personal data breach, Lensdump shall intimate the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the Act.

13.1 Lensdump and its service providers use cookies and similar technologies, which fall into the following categories:

  • Strictly necessary: a session cookie, a sign-in cookie that keeps you signed in for up to thirty (30) days, and the security cookies of our network provider. These are required for the Service to function and cannot be disabled through the Service.
  • Preference: cookies that remember your choices, such as the Grid or Stream view of an album during your visit.
  • Device id: the ld_did cookie, a random id for your browser kept for two (2) years, so that a visitor's views of a post, album or file count once a day, and so that a Member cannot refer a new account from a browser they have signed in with, and, as a keyed hash from which the id cannot be recovered, so that Lensdump can count how many different browsers visit the Service and how many come back. For a signed-in Member, a keyed hash of it is kept with the Account solely for that referral check; it is not used for advertising, and is not used to follow you across other websites.
  • Advertising measurement: the ld_adclick cookie, which holds only a random reference to the record of a click on an advertisement of Lensdump, is placed when you arrive at the Service from such an advertisement, is kept for ninety (90) days, and is removed when you next sign in, as described in clause 15. It is not placed where you connect from India, the United Kingdom, the European Economic Area or Switzerland, or from a place that cannot be determined, save as provided in clause 15.5.
  • Advertising measurement choice: the ld_measure cookie, which records only that you declined the measurement described in clause 15.5, so that you are not asked again on that browser, is kept for one hundred and eighty (180) days.

13.2 You may block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from remaining signed in and may impair the functioning of the Service.

14.1 Lensdump sends newsletters, offers and product updates only to Members who have consented to receive them, through an unticked option or their email preferences. Each such communication contains a means of unsubscribing. Account, billing, security and legal communications are not marketing communications and are sent to every Member as part of the Service.

15.1 Lensdump advertises the Service through Google Ads. Where you arrive at the Service by clicking such an advertisement, the address of the page at which you arrive contains an identifier that Google assigns to that click (the "click identifier"). Lensdump may record the click identifier together with that page (without the remainder of its address), the advertising campaign and the country from which you connect, and may place on your browser the ld_adclick cookie, which holds only a random reference to that record. Lensdump does not record your IP address or the user agent of your browser for this purpose, and does not place any script, tag or pixel of Google on the pages of the Service.

15.2 Where, after such a click, you register an Account and, within ninety (90) days of the click, sign in to it from the browser on which that cookie was placed, Lensdump may associate the click identifier with your Account. If the first payment made for your Account is made within ninety (90) days of the click, Lensdump may report that purchase to Google, together with the click identifier, comprising the reference number of the transaction, its amount and currency and the date and time at which it was made, solely to measure the effectiveness of Lensdump's own advertising. Only that first payment is reported. A click is not associated with an Account registered before the click.

15.3 Lensdump does not report to Google your name, email address, username, billing details or the particulars of your means of payment, and does not use the click identifier to compile a profile of you or for any purpose other than those stated in clauses 15.2 and 15.6. Google receives the information so reported subject to its own terms and privacy policy.

15.4 The record described in clause 15.1, with the click identifier, is retained for ninety (90) days from the click and is thereafter erased, whether or not a purchase has been reported. Where the address of a page requested, or the address of the page from which you arrived, carries a click identifier, the web server logs described in clause 11.1 record that address without its query string, and the click identifier is accordingly not retained in those logs, save that where a technical fault prevents the Service from answering such a request, the web server's record of that fault may contain the address in full and is retained for the same period. You may prevent the association described in clause 15.2 at any time by blocking or deleting the ld_adclick cookie through your browser settings.

15.5 Where you connect from India, the United Kingdom, a member state of the European Economic Area or Switzerland, or from a place that cannot be determined, the record described in clause 15.1 is not made, the ld_adclick cookie is not placed and nothing is reported to Google unless you consent to it. On the page at which you arrive from such an advertisement, Lensdump asks for that consent by a notice that states the purposes described in this clause 15 and offers the options "Allow" and "Cancel". Only where you select "Allow" are the record made, together with the date and time of your consent and the version of the notice, and the cookie placed; any report to Google under clause 15.2 then states that you consented to the use of your data for the measurement of advertising and did not consent to its use for personalised advertising. Where you select "Cancel", nothing is recorded and Lensdump places the ld_measure cookie described in clause 13.1, so that you are not asked again on that browser for one hundred and eighty (180) days. Where you make no choice, nothing is recorded.

15.6 Where the click identifier is associated with your Account under clause 15.2, Lensdump may also record with your Account that it was registered after a click on an advertisement of Lensdump, together with the advertising campaign concerned, the page at which you arrived and the date of the click, but not the click identifier. That record is used solely to measure the effectiveness of Lensdump's own advertising, including by counting the Accounts so registered and the payments made for them; it is not reported to Google, is not disclosed to any other person save as clause 9 provides, and is retained for as long as the Account exists or, where the click was recorded with your consent under clause 15.5, until you withdraw that consent under clause 15.7.

15.7 You may withdraw a consent given under clause 15.5 at any time, with the same ease with which it was given, through the option to withdraw it shown in this clause 15 on the browser on which it was given or, once the click is associated with your Account, to you while you are signed in. Withdrawal erases the record described in clause 15.1 and removes the ld_adclick cookie and, where the click is associated with your Account, erases every record of a click on an advertisement of Lensdump associated with your Account, any report to Google that has not yet been made and the record described in clause 15.6. A report already made to Google is not recalled from Google. Withdrawal does not affect the lawfulness of processing carried out before it.

16.1 Subject to the Act, you have the following rights in respect of your personal data:

  • Right to access information (section 11): to obtain a summary of the personal data being processed and the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, together with a description of the data shared;
  • Right to correction and erasure (section 12): to the correction, completion and updating of inaccurate or incomplete personal data, much of which you may effect yourself through your Account settings, and to the erasure of personal data that is no longer necessary for the purpose for which it was processed, unless retention is necessary for compliance with law; a request for erasure of your Account may be made as set out in clause 16.2;
  • Right of grievance redressal (section 13): to have readily available means of grievance redressal through the Grievance Officer named in clause 23;
  • Right to nominate (section 14): to nominate any other individual to exercise your rights in the event of your death or incapacity;
  • Right to withdraw consent (section 6), as described in clause 7.2.

16.2 Requests to exercise these rights may be submitted to the Grievance Officer from the email address registered on your Account, or through the contact page while signed in. Lensdump may take reasonable steps to verify your identity before acting on a request, and shall respond within the period prescribed under the Act. Members may additionally download their albums or selected files as an archive at any time while signed in. Persons residing in other jurisdictions may have further rights under their local law, which Lensdump shall honour to the extent applicable.

17.1 In accordance with section 15 of the Act, you shall comply with Applicable Law in exercising your rights; shall not impersonate another person while providing personal data; shall not suppress any material information while providing personal data for any document or proof issued by the State; shall not register a false or frivolous grievance or complaint; and shall furnish only verifiably authentic information when exercising the right to correction or erasure.

18.1 The Service is intended solely for persons who have attained the age of 18 years, and every person registering an Account is required to confirm that they have attained that age. Lensdump does not knowingly process the personal data of children, does not undertake tracking, behavioural monitoring or targeted advertising directed at children, and shall, upon becoming aware that an Account belongs to a child, close that Account and erase the associated personal data, save as required by law.

19.1 Lensdump may create and use aggregated or anonymised information, which does not identify any individual, for statistical, operational and business purposes. Such information is not personal data and is not subject to this Policy.

20.1 In the event of a merger, amalgamation, acquisition, reorganisation or sale of all or part of the business or assets of Lensdump, personal data may be transferred to the successor entity, which shall be bound to process it in accordance with this Policy and the Act. Any such transfer shall be undertaken in accordance with section 17 of the Act.

21.1 The Service may contain links to, or integrations with, third-party websites and services that are not operated by Lensdump. Their processing of personal data is governed by their own privacy policies, and Lensdump is not responsible for their practices.

22.1 Lensdump may amend this Policy from time to time, including to reflect changes in the Service, its processing activities or Applicable Law. Amendments take effect on publication on the Service, or on any later date stated in them, and the effective date at the top of this Policy shall be updated. Where an amendment materially affects the manner in which your personal data is processed, Lensdump shall give notice of it on the Service or by email before it takes effect and, where the Act so requires, seek your consent afresh.

23.1 Lensdump has designated the following person to respond to communications and grievances of Data Principals under the Act and the Information Technology Act, 2000:

Swadesh Shanker Parasher, Director, Lensdump Private Limited
Email: grievance@lensdump.com
Address: Road Number 9, Rajeev Nagar, Keshri Nagar, Patna, Bihar 800024, India

23.2 The Grievance Officer shall acknowledge a grievance within twenty-four (24) hours and resolve it within fifteen (15) days of receipt, or such other period as may be prescribed. Under section 13(3) of the Act, you must exhaust this grievance redressal mechanism before approaching the Data Protection Board of India, to which you may thereafter make a complaint in the manner prescribed.

24.1 Questions concerning this Policy may be addressed to the Grievance Officer at grievance@lensdump.com, through the contact page, or by post to Lensdump Private Limited, Road Number 9, Rajeev Nagar, Keshri Nagar, Patna, Bihar 800024, India.

Back to top