Your privacy, in plain English

We built Lockscreen to put you on the most personal screen there is - the lock screen. That's a privilege, and we take the trust behind it seriously. Here's exactly what we collect, why, and what you can do about it.

This is the Lockscreen Privacy Policy for people in the European Union, the European Economic Area and the United Kingdom, and we've tried to write it like a human instead of a robot. It covers our websites, dashboard, mobile experiences, APIs, and everything else we offer (we'll call all of that the "Service"). It applies whether you're a brand sending passes, a teammate in an organization, or someone who's added one of our passes to their wallet. If you're outside these regions, a different version of this policy applies to you.

1. Who we are

The Service is provided by Lockscreen LLC, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States ("Lockscreen", "we", "us", or "our").

We act in one of two roles depending on whose information it is. For personal data about our own account holders, teammates, and website visitors, we are the "controller" - we decide how and why it is handled. For the personal data our business customers (and the tools they connect, such as Klaviyo) provide about their own contacts and pass recipients, we act as a "processor" (a "service provider") - we handle that information only on the customer's documented instructions and only to provide the Service to them, never for our own separate purposes. In that case the customer is the controller, and their privacy policy tells you how they use your data.

If you ever want to reach the team that looks after privacy, jump to the last section - we genuinely read those messages.

2. What we collect

We like to be specific, so here's the full list of what we may collect. Not everyone hands over everything - it depends on how you use the Service.

Account & profile: your name, email, company, role, and profile photo.
Billing: plan and billing contact.
Content you create: passes, designs, uploads, notification copy, recipient lists, and message contents.
Usage & engagement: pages you visit, buttons you click, features you use, sessions, and how recipients interact with your passes.
Device & technical: IP address, device and browser type, operating system, identifiers, language, and diagnostic logs.
Approximate location: a rough sense of where you are, worked out from your IP and device signals.
Support & comms: emails, chats, and survey responses you send us.
Connected services: data from tools you link up, like Klaviyo, and information from partners or public sources.
Things we figure out: insights and predictions we infer from everything above, for example which messages a recipient is most likely to engage with, so we can personalise and improve the Service. This is what data protection law calls "profiling". We don't use it to make decisions that have legal or similarly significant effects on you, and section 11 explains how to object to it.

3. Where it comes from

Most of what we hold comes straight from you when you sign up and use Lockscreen. Some is gathered automatically as you and your recipients interact with passes and notifications. And some comes from integrations and partners you choose to connect, or from publicly available sources, which we may combine with the rest to give you a more complete picture.

4. How we use it

We use personal data for the specific purposes below, and for each one we've said which legal basis we rely on (section 5 explains what those are). Where we act as a processor - for the contact and recipient information our customers or their connected tools provide - we use that information only to provide and support the Service on the customer's behalf, on their instructions, and never for our own independent purposes such as advertising.

provide, maintain, secure, and deliver the Service and its features. Basis: performing our contract with you.
set up and secure accounts, authenticate users, and prevent fraud and abuse. Basis: performing our contract with you, and our legitimate interest in keeping the Service secure.
deliver the passes and notifications our customers ask us to send on their behalf. Basis: our customer's instructions as controller (we act as processor here).
respond to support requests and send service and transactional messages. Basis: performing our contract with you.
understand and improve the Service using our own account and usage data, and aggregated or de-identified data. Basis: our legitimate interest in understanding how the Service is used and making it better.
personalise the Service and choose which messages are most relevant, using the insights described in section 2. Basis: our legitimate interest in making the Service useful, or, where we act for a customer, that customer's instructions. You can object at any time (section 11).
tell you about our own products and measure how well that marketing works. Basis: your consent, which you can withdraw at any time.
meet our legal, tax, and compliance obligations. Basis: complying with legal obligations that apply to us.

5. Why we're allowed to

Data protection law says we need a "legal basis" for every use of your personal data. We rely on four:

Contract: we need the data to provide the Service you've signed up for, or to take steps before you sign up.
Legitimate interests: we have a genuine business reason that doesn't override your rights and freedoms. Our legitimate interests are keeping the Service secure, understanding how it is used so we can improve it, and making it relevant to the people who use it. You can object to any use based on legitimate interests, and we'll stop unless we have a compelling reason to continue.
Consent: for marketing about our own products, and for non-essential cookies, we ask first. You can withdraw consent at any time, and it won't affect anything we did before you withdrew it.
Legal obligation: sometimes the law requires us to keep or share data, for example for tax records or a valid legal request.

Section 4 tells you which basis applies to which purpose. If we ever need fresh consent for something new, we'll ask.

6. Who we share it with

We share personal data only as needed to run the Service:

with service providers and processors who work for us and on our instructions (hosting, payment processing, analytics, customer support, and email delivery). Our hosting provider is Fly.io, with servers and databases in Amsterdam, Netherlands. We'll give you our current list of service providers if you ask.
with the integration partners a customer chooses to connect, such as Klaviyo, solely to operate that integration for the customer.
with our group companies and affiliates, under this policy.
with the parties involved if our business is ever part of a merger, financing, or sale, under confidentiality.
where the law requires it, or to enforce our agreements and protect people's rights, safety, and property.

We do not sell your personal data. We do not share the contact or recipient information we process on our customers' behalf - including information received from connected tools such as Klaviyo - with any third party for that third party's own purposes, including marketing or advertising.

7. How long we keep it

We keep personal data only for as long as we need it for the purposes above. In practice that means:

Account and profile data: while your account is active, and deleted within 30 days of your account closing unless we need to keep it for the reasons below.
Billing records: for as long as tax and accounting law requires, which is typically up to 7 years.
Recipient and pass data we process for a customer: while the recipient's pass is active. If a pass becomes inactive (the recipient removes it, or the customer stops distributing passes), we delete the recipient record within 24 months. When a customer closes their account or asks us to delete a recipient, we delete that data within 30 days.
Support and communications: for up to 2 years after the conversation ends, so we can follow up on issues.
Usage, device and diagnostic logs: for up to 12 months, then deleted or de-identified.

We may keep data for longer where we need it to resolve a dispute or enforce our agreements. Once data is de-identified or aggregated so it no longer points to you, we may keep and use it indefinitely.

8. Cookies & tracking

We and our partners use cookies, SDKs, pixels, and similar technologies to keep you signed in, remember your preferences, measure performance, and support analytics. Cookies that are strictly necessary for the Service to work are always on. Any other cookies, including analytics and advertising cookies, are set only with your consent, which we ask for when you first visit and which you can change at any time through the cookie settings on our site or your browser or device settings.

9. Where it's stored

Our servers and databases are located in the European Union (Amsterdam, Netherlands). Lockscreen LLC is based in the United States, so some processing - for example administration and support by our staff - involves access from the United States. Where personal data is transferred outside the EU, EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and, for the UK, the UK Addendum to those clauses) to protect it, alongside the security measures in section 10. You can ask us for a copy of the safeguards we use.

10. How we protect it

We use technical and organisational measures designed to protect your information, like encryption in transit (TLS) and encryption at rest, access controls with multi-factor authentication, and monitoring. That said, no method of sending or storing data is completely secure, so we can't promise perfection - and we'll always be straight with you if something goes wrong. If a security incident affects your personal data, we'll notify the relevant regulator and, where required, you within the legal timeframes.

11. Your choices & rights

If you're in the EU, EEA or UK, you have the right to:

Access the personal data we hold about you, and get a copy of it.
Correct it if it's wrong or incomplete.
Delete it, in certain circumstances.
Restrict how we use it, in certain circumstances.
Take a copy elsewhere in a machine-readable format (portability).
Object to uses based on our legitimate interests, including profiling.
Object to direct marketing at any time, including profiling for marketing. If you object, we'll stop.
Withdraw consent at any time, where we rely on consent.
Complain to a data protection regulator. If you're in the EU, that's the regulator in the country where you live or work. If you're in the UK, it's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort it out first, so please get in touch with us before you do.

To make a request, email us at the address below - we won't make you jump through hoops. We'll respond within one month, and we won't charge you unless a request is clearly unfounded or excessive. We may need to confirm your identity first.

If your data was given to us by one of our customers (for example, you've added their pass to your wallet), that customer is the controller. Please send your request to them, and we'll help them deal with it. You can also opt out of marketing at any time using the link in our emails.

12. Children

The Service is built for businesses and isn't directed at children. We don't knowingly collect personal data from anyone under the age required in their country (16 in most EU countries, 13 in the UK). If you think a child has given us data, let us know and we'll remove it.

13. Say hello

If anything here is unclear, or you want to exercise a right, email us at priority@lockscreen.ai or write to Lockscreen LLC, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. We're happy to help and we promise not to reply in legalese.