Privacy policy

LotteryCortex processes personal data in accordance with the EU General Data Protection Regulation (GDPR). This privacy policy explains what data we collect, why we use it, which subprocessors support our services, how long we retain data, which cookies we use, and how you can exercise your GDPR rights.

What personal data do we collect?

Account data: We collect your email address and password hash when you sign up. Payment data: Stripe processes your name, billing address, and country; we do not receive card data. Usage data: We collect anonymous statistics about which lotteries you view. Log data: We record your IP address and user agent on API calls for security and debugging.

Why do we use your personal data?

We use your data to create your account and authenticate you, manage subscriptions and send invoices, improve the product based on aggregated usage, and detect abuse and fraud. We do not send marketing emails without an explicit opt-in.

Which subprocessors do we use?

Stripe (payments, Ireland/USA), Supabase via Lovable Cloud (database and auth, EU), and Resend (transactional email, EU/USA). Each subprocessor has a data processing agreement with us or relies on standard contractual clauses (SCCs) for transfers outside the EU.

Which cookies do we use?

We use only strictly necessary cookies (session, language preference). We use no tracking cookies or third-party advertising cookies unless you give explicit consent via our cookie banner once it is activated.

What are your GDPR rights?

Under the GDPR, you have the rights to access, rectification, erasure, restriction, data portability, and objection. Send a request to hello@lotterycortex.com, and we will respond within 30 days. To file a complaint, contact the Polish supervisory authority (UODO) or your local data protection authority.

How long do we retain your data?

Account data: until you delete your account. Invoice data: 7 years (statutory retention). Logs: maximum 90 days.