LotwiseLotwise legal
Lotwise Privacy Notice
This Privacy Notice explains how Lotwise collects, uses, and shares personal information when you use our software and related services.
It is written for clarity. It is an initial production draft and is not a substitute for professional data-protection advice before public release.
1. Who we are
The data controller for Lotwise account and service personal data is Lotwise Ltd. Lotwise Ltd is in the process of being formed as a UK limited company. Company number and registered office will be published here once incorporation is complete. Company number: [COMPANY NUMBER — PENDING INCORPORATION]. Registered office: [REGISTERED OFFICE — PENDING INCORPORATION].
Privacy / data protection contact: [PRIVACY / DATA EMAIL]. Support contact: [SUPPORT EMAIL].
ICO registration: [ICO REGISTRATION DETAILS IF APPLICABLE].
2. Information we collect
Account information: name, email address, mobile number, authentication identifiers, and password credentials handled by our authentication provider.
Business profile: business/trading name, trading type, requested user count, approximate inventory size, catalogue category preferences, and related application details. Where you upload a business logo or other profile content, we process that content to display it in the service.
Inventory information: items/cards you record, purchase cost and acquisition details, status, quantities, and related value fields you enter.
Transaction information: buys, sales, trades, and related values, costs, and profit information you record.
Team and access information: membership roles, invites, and device/sync registration details needed to operate multi-user and sync features.
Technical and security data: session information, device/sync identifiers, application logs, and security/audit events needed to operate and protect the service.
Support communications: information you send us when you contact support.
Marketing preference: whether you have opted in or out of optional product news and offers by email.
We do not state that Lotwise collects advertising identifiers or behavioural marketing profiles unless such features are later introduced and this notice is updated.
3. How we obtain information
Most information is provided directly by you or your authorised team members when registering, using Lotwise, or contacting us.
Some technical and security information is generated automatically when you use the apps or websites (for example session and log data).
Where catalogue or market-data features are enabled for your account, Lotwise may retrieve third-party catalogue or market evidence data related to products you look up; that product data is generally not personal data about you, though lookup activity may be associated with your account for service operation.
4. Why we use information and lawful bases
We do not process all personal information on the basis of consent. Different purposes rely on different lawful bases under UK GDPR.
Contract: creating and providing your account; delivering Lotwise functionality; syncing inventory and transactions; processing your instructions; providing subscribed or approved services.
Legitimate interests: securing the platform; preventing fraud and abuse; maintaining reliability and diagnosing faults; limited service analytics needed to operate the product. We use this basis only where we consider the balancing test can reasonably be supported. You may object where applicable.
Legal obligation: where we must retain or process records to meet legal requirements.
Consent: optional direct marketing emails (product news, offers and updates), and any future non-essential cookies or similar tracking if introduced. You can withdraw marketing consent at any time without affecting your ability to use Lotwise.
Transactional and service emails (for example signup confirmation, approval decisions, password reset, security alerts, and essential account notices) are sent as part of providing the service and do not depend on marketing consent.
6. Service providers and processors
Based on the current Lotwise architecture, personal data may be processed by:
Supabase — authentication, database hosting, and related account/session infrastructure.
Resend — transactional email delivery.
Render and related hosting infrastructure — application hosting for web and API services.
OpenAI — only where vision/recognition features are enabled for an environment; image and related request data needed for that feature may be processed. Where the feature is disabled or stubbed, this processing does not occur for production use.
Catalogue and market-data providers (for example TCGdex and other configured catalogue sources) — product/catalogue lookups where those integrations are enabled.
Mobile distribution and on-device tooling (for example Expo/EAS distribution channels and on-device OCR libraries) — as needed to deliver and run the mobile application.
We do not publish API keys, secrets, or internal security configuration in this notice.
7. International transfers
Some providers may process data outside the United Kingdom. Where international transfers occur, we will use an appropriate transfer mechanism as required by UK data protection law.
[INTERNATIONAL TRANSFER MECHANISM DETAILS TO BE CONFIRMED].
8. Security
We apply technical and organisational measures appropriate to the nature of the service, including access controls, authenticated APIs, and separation of customer workspaces.
No method of transmission or storage is completely secure. Please protect your account credentials and notify us promptly of suspected unauthorised access.
9. Retention and deletion
We retain personal information only as long as needed for the purposes described in this notice, including providing the service, resolving disputes, enforcing agreements, and meeting legal requirements.
Account data: [RETENTION PERIOD TO BE CONFIRMED — account data].
Inventory and transaction records: [RETENTION PERIOD TO BE CONFIRMED — inventory and transaction records].
Security and audit logs: [RETENTION PERIOD TO BE CONFIRMED — security and audit logs].
Support communications: [RETENTION PERIOD TO BE CONFIRMED — support communications].
When you request deletion, we will assess the request. Immediate deletion of every record is not always possible where legitimate or legal retention requirements apply.
10. Your rights
Under UK data protection law, you may have rights to access, correct, delete, restrict, or object to certain processing; to data portability; to withdraw consent where processing is based on consent; and to complain to the Information Commissioner’s Office (ICO).
To exercise rights, contact [PRIVACY / DATA EMAIL]. We may need to verify your identity before responding.
ICO: https://ico.org.uk/
11. Marketing preferences
If you opt in to product news and offers, we will use your email for that purpose. You can withdraw at any time from Account → Legal & Privacy (or equivalent in the mobile app) or by contacting us.
Withdrawing marketing consent does not delete or alter your acceptance of the Terms of Service or acknowledgement of this Privacy Notice, and does not stop essential service emails.
13. Changes to this Privacy Notice
This Privacy Notice is version 2026-08-v1, last updated 22 August 2026.
We may update this notice from time to time. Where changes are material, we will provide notice by reasonable means and may ask you to acknowledge the updated notice before continued use.
14. Contact and complaints
Privacy questions: [PRIVACY / DATA EMAIL].
General support: [SUPPORT EMAIL].
You can also complain to the ICO (https://ico.org.uk/) if you are unhappy with how we handle personal information.