Lotwise Privacy Notice

1. Who we are

The data controller for Lotwise account and service personal data is LotwiseCollects Ltd. LotwiseCollects Ltd is a UK private limited company (company number 17419225). Company number: 17419225. Registered office: 31 The Rise, Borehamwood, United Kingdom, WD6 3JR.

Privacy and data-protection contact: scott@lotwisecollects.com. Support contact: scott@lotwisecollects.com.

Our primary public website is https://lotwisecollects.com. The Lotwise application web service is https://app.lotwisecollects.com.

Lotwise accounts are available only to people aged 18 or over.

2. Information we collect

Account information: name, email address, mobile number, authentication identifiers, and password credentials handled by our authentication provider. Lotwise staff cannot see your password in readable (plaintext) form.

Business and application information: business or trading name, trading type, requested user count, approximate inventory size, catalogue category preferences, and related application details. Where you upload a business logo, avatar or other profile content, we process that content to display it in the service. Invoice or company profile fields you choose to complete, such as legal name, address and phone number, are also processed.

Account membership and team information: membership roles, invites, and the association between users and a workspace.

Inventory and product records: items and cards you record, purchase cost and acquisition details, status, quantities, and related value fields you enter.

Transaction and operational records: purchases, sales, trades, stock and cash adjustments, and related values, costs and profit information you record.

Analytics generated from the business, inventory and transaction data in your workspace.

Device and cloud synchronisation information needed to operate multi-device sync, including device or sync identifiers associated with your account.

Technical, API, network and security information generated when you use the apps or websites, including session information, application logs, and security or audit events needed to operate and protect the service.

Support correspondence: information you send us when you contact support, and account deletion request records you submit.

Marketing preference: whether you have opted in or out of optional product news and offers by email.

The current Store V1 release does not collect card images for scanning, OCR or AI vision processing. We do not currently operate advertising identifiers or behavioural marketing profiles.

3. How we obtain information

Most information is provided directly by you or your authorised team members when registering, using Lotwise, or contacting us.

Some technical, network and security information is generated automatically when you use the apps or websites.

Where catalogue or informational market-guide features are enabled, Lotwise may retrieve third-party catalogue or market evidence data related to products you look up. That product data is generally not personal data about you, though lookup activity may be associated with your account for service operation.

4. Why we use information and lawful bases

We do not process all personal information on the basis of consent. Different purposes rely on different lawful bases under UK GDPR.

Contract: creating and administering your account; authenticating you; onboarding a business or customer application; providing inventory, purchase, sale, trade, stock/cash adjustment, Show Mode, analytics and related workspace functionality; synchronising devices; operating the service you requested; and sending essential service emails such as signup confirmation, approval decisions, password reset, security alerts and important account notices.

Legitimate interests: operating, protecting and improving the service; preventing fraud, abuse and misuse; maintaining security and reliability; diagnosing faults; and limited operational analytics needed to run Lotwise. We use this basis only where we consider those interests are not overridden by your rights. You may object where applicable.

Legal obligation: where we must retain or process records to meet tax, accounting, legal or similar requirements.

Consent: optional direct marketing emails (product news, offers and updates), and any future non-essential cookies or similar tracking if introduced. You can withdraw marketing consent at any time without affecting your ability to use Lotwise. Consent is not used as a catch-all basis for operating the service.

5. Who we share information with

We share personal information with service providers who process it on our instructions to operate Lotwise, and with others where required by law or necessary to protect rights and security.

We do not sell your personal information.

6. Service providers and processors

Personal information for Store V1 may be processed by:

Supabase — authentication, database hosting, and related account and session infrastructure.

Lotwise application hosting, currently provided using Render — hosting for the Lotwise API and web application.

Resend — transactional email delivery.

Catalogue and market-data providers, including TCGdex, where product lookups or informational market guides are enabled.

If you download Lotwise from Google Play, Google processes information as the app store operator under Google’s terms.

The current Store V1 release does not send customer card images to an AI vision provider.

We do not publish API keys, secrets, or internal security configuration in this notice.

7. International transfers

Some of our providers may process personal information outside the United Kingdom. Where that happens, we use providers on the basis that UK data protection law still applies to our use of their services, and we expect those providers to apply appropriate protections to personal information.

The specific legal transfer mechanism used with each provider is kept under review. If you have questions about a particular transfer, contact us at the privacy email below.

8. Security

We apply technical and organisational measures appropriate to the nature of the service. These include encrypted network transport between the apps/websites and Lotwise systems, authentication, access controls, and server-side safeguards intended to keep customer workspaces separate.

No method of transmission or storage is completely secure. Please protect your account credentials and notify us promptly of suspected unauthorised access.

9. How long we keep information

We do not intend to retain identifiable personal information indefinitely without purpose. We keep information only as long as needed for the purposes in this notice, including providing the service, resolving disputes, enforcing agreements, and meeting legal requirements, and we review retention requirements periodically.

Active account, profile, inventory and workspace information is kept while the account remains active and the information is required to provide the service.

Following a valid account deletion request, operational account information that we no longer have a lawful reason to retain is normally deleted or anonymised within 30 days of the request being verified. Some information may be kept longer where the following paragraphs apply.

Certain transaction or accounting information may need to remain after account deletion where required for tax, accounting, fraud-prevention or legal obligations. Where that applies, we may retain the relevant records for up to six years after the relevant financial or accounting period, or longer where law requires. This does not mean every inventory record is kept for six years.

Security and operational logs are normally kept for up to 12 months, unless investigation, security, legal or abuse-prevention requirements justify a longer period.

Support correspondence is normally kept for up to 24 months after the support matter is resolved, unless required for an ongoing dispute or legal obligation.

We retain the minimum record reasonably needed to show that an account deletion request was received and actioned, for up to six years.

10. Account deletion

You can request deletion of your Lotwise account. If you can sign in as the account owner, you may use the Delete account control in the Lotwise app or web account settings. If you cannot sign in, you can submit a request at https://lotwisecollects.com/delete-account or email scott@lotwisecollects.com.

Public website requests are reviewed before action is taken. Owner self-service deletion in the signed-in product removes the active business account when the confirmation step is completed.

Deletion removes information Lotwise no longer has a lawful reason to retain. Limited information may continue to be held where required for legal obligations, accounting or tax requirements, fraud or security, or the establishment, exercise or defence of legal claims.

Deleting your Lotwise cloud account does not automatically erase information outside Lotwise’s technical control, such as copies you exported, emails already delivered to you, or information held by an app store operator.

11. Information on your devices

Some Lotwise information is stored locally on your devices so the mobile app can operate, including local inventory and related operational data.

Uninstalling the app or clearing application data affects device-local information. That is separate from deleting information stored on Lotwise systems. Cloud account deletion does not automatically erase every local copy on every device that previously signed in.

12. Your rights

Under UK data protection law, you may have rights to access your personal information, to have inaccurate information corrected, to request erasure, to restrict certain processing, to object to processing based on legitimate interests, and to data portability. Where we rely on consent, you may withdraw that consent. These rights are not always absolute and may not apply in every circumstance.

To exercise rights, contact scott@lotwisecollects.com. We may need to verify your identity before responding.

You also have the right to complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/.

13. Marketing preferences

If you opt in to product news and offers, we will use your email for that purpose. You can withdraw at any time from Account → Legal & Privacy (or equivalent in the mobile app) or by contacting us.

Withdrawing marketing consent does not delete or alter your acceptance of the Terms of Service or acknowledgement of this Privacy Notice, and does not stop essential service emails.

14. Cookies and similar technologies

Lotwise currently uses strictly necessary cookies and similar technologies for authentication and session management (and limited first-party preferences such as selected organisation).

We do not currently operate non-essential analytics, advertising, or behavioural tracking cookies in the Lotwise web or marketing applications. If that changes, we will update this notice and, where required, present a separate consent mechanism before activating non-essential categories.

See the Lotwise Cookie Notice for more detail.

15. Changes to this Privacy Notice

This Privacy Notice is version 2026-09-v1, last updated 14 September 2026.

We may update this notice from time to time. Where changes are material, we will provide notice by reasonable means and may ask you to acknowledge the updated notice before continued use.

16. Contact and complaints

Privacy questions: scott@lotwisecollects.com.

General support: scott@lotwisecollects.com.

You can also complain to the ICO (https://ico.org.uk/) if you are unhappy with how we handle personal information.