The honest answer: we are built around GDPR's principles, but we have not been independently audited, and we have gaps we still need to close. Many companies answer "are you GDPR compliant?" with a badge. We would rather show you what we store, for how long, who processes it and where we fall short, so you can judge for yourself.
Lupyd is made by Lupyd Media Private Limited, a company based in India. The EU's General Data Protection Regulation (GDPR) still applies to us whenever we offer our service to people in the EU. This post explains what GDPR asks of a messaging service, then holds Lupyd to that standard.
The Short Answer
- What is strong: message, file and backup content is end-to-end encrypted on your device, so we cannot read it. We do not use advertising SDKs or third-party trackers, and we do not sell personal data.
- What our servers can see: the metadata needed to deliver messages, such as usernames, devices, who messaged whom and when, and group names and membership.
- What is missing: no external audit or certification yet, no EU representative, no self-serve data export, and some relay data is deleted on a schedule rather than at the moment you delete your account.
What GDPR Requires of a Messaging Service
GDPR is not a certificate you earn once. It is a set of ongoing obligations. Article 42 allows approved certification schemes, but there is no single official "GDPR certified" status that every company obtains. When a vendor says it is certified, ask by whom and against what.
| Article | Topic | What it means |
|---|---|---|
| Art. 3 | Territorial scope | Applies to companies outside the EU that offer services to people in the EU. |
| Art. 5 | Principles | Lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. |
| Art. 6 | Lawful basis | Every processing activity needs a basis, such as performing a contract, a legal obligation, legitimate interests or consent. |
| Arts. 12–22 | Data subject rights | Access, rectification, erasure, restriction, portability and objection, answered within one month. |
| Art. 25 | Data protection by design and by default | Build privacy into the product, and collect only what each feature needs. |
| Art. 28 | Processors | Use only providers that give sufficient guarantees, under a written contract. |
| Art. 32 | Security | Appropriate technical measures, explicitly including encryption. |
| Arts. 33–34 | Breach notification | Tell the supervisory authority within 72 hours; tell users unless the data was unintelligible to attackers, for example because it was encrypted. |
| Art. 27 | EU representative | Non-EU companies offering services in the EU generally need a representative in the EU. |
| Arts. 44–49 | International transfers | Personal data leaving the EU needs a safeguard, such as an adequacy decision or standard contractual clauses. |
Fines for serious breaches can reach €20 million or 4% of worldwide annual turnover, whichever is higher. Encryption matters under GDPR in two specific ways: Article 32 names it as a security measure, and Article 34 says a company need not notify individuals of a breach if the stolen data was unintelligible, for example because it was encrypted.
What Lupyd Stores
This inventory comes from our own code and database schemas, not from marketing copy.
| Data | Where it lives | Can Lupyd read it? |
|---|---|---|
| Message, file and backup content | Our relay and Cloudflare R2 | No. End-to-end encrypted on your device (Signal Protocol for direct messages, MLS for groups; files and backups encrypted before upload) |
| Email address and sign-in credentials | Auth0, EU tenant | Held by Auth0; not stored in Lupyd's own databases |
| Username, account ID, bio, settings | Lupyd database | Yes |
| Public posts | Lupyd database | Yes. Posts are public by design |
| Device records: device ID, platform, last connected time, push token | Lupyd relay database | Yes |
| Delivery metadata: sender, recipient and timestamp of each queued message | Lupyd relay database | Yes, content stays encrypted |
| Conversation list, message requests, blocks, privacy settings | Lupyd relay database | Yes |
| Group name, description, members, roles, join and leave times | Lupyd relay database | Yes. Group messages are encrypted, but group names and membership are not |
| Meeting participation: who joined a call and when | Lupyd relay database | Yes |
| Payment records | Razorpay and Lupyd billing database | Yes, as needed for billing and tax law |
What we do not collect:
- No phone number is required to sign up, and we do not upload your address book.
- No advertising or analytics SDKs in our apps, and no third-party tracking scripts on our websites.
- No message content in push notifications. A push only tells your device to fetch new encrypted messages.
- No server-side search. Search runs on your device, so your search terms never reach us.
- No IP address logging in our own application servers. Cloudflare, which sits in front of our services, does keep request logs that include IP addresses.
Two features are less private than our messages, and you should know which. Group names, descriptions and member lists are visible to our servers, because the relay needs them to route messages and enforce roles. And group video calls run through Cloudflare's real-time service and are not yet end-to-end encrypted.
How Long We Keep It
GDPR's storage limitation principle says data should be kept no longer than necessary. These are the retention rules our servers enforce today:
| Data | Retention |
|---|---|
| Encrypted direct messages already delivered to your device | Deleted from our relay 30 days after delivery |
| Encrypted direct messages not yet delivered | Kept until delivered, or until the device is removed |
| Encrypted group messages | Kept for the life of the group, so new devices can sync history; deleted with the group |
| Unused web devices | Removed after 14 days without use |
| Unused mobile and desktop devices | Removed after 90 days without use (your most recent one is kept) |
| Group invites and join requests | 90 days and 30 days |
| Public posts | Expire after one year by default |
| Your profile and sign-in account | Deleted when you delete your account in the app |
| Payment records | Kept as long as financial and tax law requires |
Who Processes It: Our Sub-processors
No company runs everything itself. These providers process personal data on our behalf:
| Provider | Purpose | Data involved |
|---|---|---|
| Auth0 (Okta) | Sign-in, password and Google login, multi-factor authentication | Email address, sign-in credentials, login events |
| Cloudflare | Websites, CDN, encrypted file and backup storage (R2), call relays and group calls | Encrypted files, request logs including IP addresses, username for call sessions |
| Google Firebase Cloud Messaging | Push notifications on Android | Push token and a content-free "new message" signal |
| Razorpay | Payments | Payment and billing details |
Because Lupyd is an Indian company and several of these providers are global, personal data of EU users is processed outside the EU. India does not have an EU adequacy decision, so these transfers need safeguards under Articles 44–49.
Where We Fall Short Today
Transparency means listing the gaps as clearly as the strengths:
No external audit or certification. No independent auditor has assessed our security or data protection practices, and we hold no ISO 27001, SOC 2 or GDPR certification. Our encryption engine, Firefly, is open source, so its design can be reviewed, but that is not the same as an audit.
No EU representative or formal data protection officer. Article 27 generally requires non-EU companies serving EU users to appoint one. We have not yet done so.
Transfer safeguards not yet published. We have not yet published the contractual safeguards that cover EU data processed in India and by our global providers.
No self-serve data export. You can create encrypted backups of your own messages, but there is no one-click export of your account data yet. Portability requests are handled by email.
Deletion is not yet instant everywhere. Deleting your account removes your profile and sign-in account immediately. Some encrypted relay data, such as device records and undelivered message ciphertext, is currently removed by our scheduled retention jobs rather than at the moment of deletion. We keep a minimal record of the deleted username and account ID.
Our privacy policy needs to catch up. It was written in 2025 with broader categories than the product actually collects. We are rewriting it to match this inventory, including lawful bases and the sub-processor list.
Your Rights and How to Use Them
Under GDPR you can ask us to tell you what personal data we hold about you, give you a copy, correct it, delete it, restrict or object to how we use it, and move it elsewhere.
- Delete your account: in the app, under Settings.
- Everything else: email privacy@lupyd.com. We will respond within one month, as GDPR requires.
- Complaints: you also have the right to complain to the data protection authority in your EU country.
One limit is built into the design: because we cannot decrypt your messages, we cannot hand you or anyone else their content. Your messages live on your devices and in backups only you can unlock.
Our Commitments
Until an auditor can verify our claims, here is what we promise, and what you can hold us to:
Encrypt content by default. Messages, files and backups stay end-to-end encrypted, with keys on your devices.
Collect the minimum. No phone number, no contact upload, no advertising or tracking SDKs, and no selling of personal data.
Tell you if something goes wrong. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
Close the gaps above, and say so here. We will update this page as each one is fixed, and publish the results when we complete an external audit.
Keep this inventory current. When a feature changes what we store, this page changes too.
If you run a business in India, many of the same principles apply under the DPDP Act; see our DPDP Act guide for team messaging. To compare how other apps handle encryption, see which messaging apps are end-to-end encrypted. Or try Lupyd and see for yourself.
Frequently Asked Questions
Is Lupyd GDPR compliant?
Lupyd is designed around GDPR principles such as data minimisation and encryption, and message content is end-to-end encrypted. We have not had an independent external audit, and we have known gaps, including no EU representative yet and no self-serve data export, so we do not claim full certified compliance.
Can Lupyd read my messages?
No. Direct messages use the Signal Protocol and groups use MLS, with keys generated and kept on your devices. Files and backups are encrypted on your device before upload. Our servers store ciphertext they cannot decrypt, though they do see delivery metadata such as usernames, timestamps and group membership.
Is there an official GDPR certification?
GDPR allows approved certification schemes under Article 42, but there is no single official GDPR certificate that every company obtains. Compliance is an ongoing obligation. Claims of being "GDPR certified" usually refer to a third-party audit or a specific scheme.
How do I get a copy of my data or delete my Lupyd account?
You can delete your account in the app under Settings. For a copy of your data, correction, or any other request, email privacy@lupyd.com and we will respond within one month, as GDPR requires.
Does Lupyd sell data or show ads?
No. Lupyd does not sell personal data, and our apps and websites do not include advertising SDKs or third-party tracking scripts.
Final Takeaway
Compliance badges are easy to print and hard to verify. Encryption you can inspect, a data inventory you can read and a list of gaps you can hold us to are harder to fake. Lupyd cannot read your messages, keeps less than most messaging services, and still has work to do before an auditor can confirm it. We will keep this page honest while we do it.
Sources & References:
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), official text
- GDPR Article 3: Territorial scope
- GDPR Article 5: Principles
- GDPR Article 12: Transparent information and response times
- GDPR Article 27: Representatives of non-EU controllers
- GDPR Article 32: Security of processing
- GDPR Article 34: Communicating a breach to data subjects
- GDPR Article 42: Certification
- GDPR Article 83: Administrative fines
- European Commission: Adequacy decisions
- EDPB: National data protection authorities
Last updated: 2 November 2026. This page describes Lupyd's data practices as of that date and is not legal advice. Questions or corrections: privacy@lupyd.com.
- ✓ GDPR applies to any service offered to people in the EU, wherever the company is based, so it applies to Lupyd even though we are an Indian company.
- ✓ There is no single official 'GDPR certified' badge; compliance is an ongoing set of obligations, and Lupyd has not yet had an independent external audit.
- ✓ Message, file and backup content is end-to-end encrypted on your device; our servers store ciphertext they cannot read.
- ✓ Our servers do see some metadata to deliver messages: usernames, device records, who messaged whom and when, group names and membership.
- ✓ We use Auth0 for sign-in, Cloudflare for storage, websites and calls, Google Firebase for content-free push notifications, and Razorpay for payments.
- ✓ Known gaps include no external audit, no EU representative yet, no self-serve data export, and deletion of some relay data happening on a schedule rather than instantly.
The workspace where nothing leaks
End-to-end encrypted channels and chat for your team, built on the Signal Protocol and MLS. Available on macOS, Windows, Linux and Android.
