Privacy Policy

Last updated: 19 April 2026 · LOTLY PTY LTD (ABN 39 694 638 607)

1. Overview
This Privacy Policy explains how LOTLY PTY LTD (ABN 39 694 638 607, ACN 694 638 607) collects, uses, discloses and protects personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What We Collect
We collect: Account Info (name, email, phone); Usage & Technical Data (IP, device, pages, features used); Property Research Data (saved favourites, pipeline items, notes, tags, attachments); Communications (contact form submissions, support requests); Payment Data (subscription status via Stripe — we do not store card details); AI Interaction Data (property data and context you provide for AI analysis); and Analytics (aggregated usage). We do not intentionally collect sensitive information. Do not include sensitive data in free-text fields.

3. How We Use Information
To provide and improve the Service; process subscriptions; respond to support requests; monitor usage quotas; detect fraud; and comply with legal obligations.

4. Third-Party Service Providers
We share data with: Firebase Authentication (Google — email, auth tokens); Firestore (Google Cloud — account data, favourites, pipeline, notes, messages); Stripe (payment processing — user ID, subscription status); Google Gemini (AI analysis — property data and user context, processed outside Australia); Google Maps (mapping — searched coordinates); Nominatim/OSM (geocoding — coordinates); Valhalla (routing — coordinates, self-hosted in Australia). We do not sell personal information.

5. Authentication
We use Firebase Authentication (Google). If you sign in with Google, we receive your name, email, and profile photo. We never see or store your password.

6. Cookies & Tracking
We use essential cookies and session storage for authentication (Firebase SDK) and user preferences. Google Maps may set its own cookies. We use Google Tag Manager to measure usage and conversion events. We do not use third-party advertising cookies for retargeting.

7. Overseas Disclosure
Your information may be transferred outside Australia (primarily USA) where our providers operate. When using AI features, data is processed by Google Gemini outside Australia. We take reasonable steps to ensure compliance with Australian privacy laws.

8. Data Security
We use industry-standard security (TLS, secure auth, access controls). No system is absolute.

9. Data Retention & Deletion
Account deletion (via Settings) removes your profile, favourites, pipeline, notes, and attachments within 60 days. Contact form submissions may be retained for 12 months. Anonymised data may be retained indefinitely.

10. Data Breach Notification
In the event of a data breach likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with Part IIIC of the Privacy Act (Notifiable Data Breaches scheme).

11. Marketing
You may receive transactional emails. Promotional emails include an unsubscribe link. You can also opt out by contacting support@lotly.com.au.

12. Access, Correction & Complaints
You may request access to or correction of your info. If you have a complaint, contact support@lotly.com.au. We respond within 30 days. You may also contact the OAIC at www.oaic.gov.au.

13. Contact
LOTLY PTY LTD · ABN 39 694 638 607 · support@lotly.com.au