Your privacy, in plain English

This is the Lockscreen Privacy Policy for people in the United States, and we've tried to write it like a human instead of a robot. It covers our websites, dashboard, mobile experiences, APIs, and everything else we offer (we'll call all of that the "Service"). It applies whether you're a brand sending passes, a teammate in an organization, or someone who's added one of our passes to their wallet. If you're in the European Union, the European Economic Area or the United Kingdom, a different version of this policy applies to you.

1. Who we are

The Service is provided by Lockscreen LLC, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States ("Lockscreen", "we", "us", or "our").

We act in one of two roles depending on whose information it is. For personal information about our own account holders, teammates, and website visitors, we are the "business" (or "controller") - we decide how and why it is handled. For the personal information our business customers (and the tools they connect, such as Klaviyo) provide about their own contacts and pass recipients, we act as a "service provider" (or "processor") - we handle that information only on the customer's instructions and only to provide the Service to them, never for our own separate purposes. In that case the customer's privacy policy tells you how they use your data.

If you ever want to reach the team that looks after privacy, jump to the last section - we genuinely read those messages.

2. What we collect

We like to be specific, so here's the full list of what we may collect. Not everyone hands over everything - it depends on how you use the Service.

• Account & profile: your name, email, company, role, and profile photo.
• Billing: plan and billing contact.
• Content you create: passes, designs, uploads, notification copy, recipient lists, and message contents.
• Usage & engagement: pages you visit, buttons you click, features you use, sessions, and how recipients interact with your passes.
• Device & technical: IP address, device and browser type, operating system, identifiers, language, and diagnostic logs.
• Approximate location: a rough sense of where you are, worked out from your IP and device signals.
• Support & comms: emails, chats, and survey responses you send us.
• Connected services: data from tools you link up, like Klaviyo, and information from partners or public sources.
• Things we figure out: insights and predictions (what privacy laws call "inferences") that we draw from everything above, for example which messages a recipient is most likely to engage with, so we can personalise and improve the Service.

We don't set out to collect sensitive personal information (like government ID numbers, precise location, health or financial account details), and we ask you not to put it in your passes or messages.

3. Where it comes from

Most of what we hold comes straight from you when you sign up and use Lockscreen. Some is gathered automatically as you and your recipients interact with passes and notifications. And some comes from integrations and partners you choose to connect, or from publicly available sources, which we may combine with the rest to give you a more complete picture.

4. How we use it

We use personal information for the specific purposes below. Where we act as a service provider - for the contact and recipient information our customers or their connected tools provide - we use that information only to provide and support the Service on the customer's behalf, on their instructions, and never for our own independent purposes such as advertising.

• provide, maintain, secure, and deliver the Service and its features;
• set up and secure accounts, authenticate users, and prevent fraud and abuse;
• deliver the passes and notifications our customers ask us to send on their behalf;
• respond to support requests and send service and transactional messages;
• understand and improve the Service, including how we choose and time messages, using our own account and usage data, engagement data from passes and notifications, and aggregated or de-identified data;
• personalise the Service and choose which messages are most relevant, using the insights described in section 2;
• tell you about our own products and measure how well that marketing works (you can opt out at any time, see section 11); and
• meet our legal, tax, and compliance obligations.

5. Why we're allowed to

US privacy law doesn't ask us to name a legal basis for each use of your data. It asks us to tell you clearly what we do, to do only that, and to respect the choices the law gives you. So that's the deal: we use your information for the purposes in section 4 and nothing else. Where we act as a service provider for a customer, we're also bound by our contract with them to use their recipients' information only on their instructions. Where we use engagement data to improve the Service, we stay within the limits US privacy law sets for service providers: we don't use one customer's data to run the Service for another, we don't build profiles of individuals across customers, and we never sell it or use it for our own advertising. If we ever want to use your information for something new, we'll update this policy and, where the law requires it, ask you first.

6. Who we share it with

We share personal information only as needed to run the Service:

• with service providers who work for us and on our instructions (hosting, payment processing, analytics, customer support, and email delivery). Our hosting provider is Fly.io, with servers and databases in Amsterdam, Netherlands. We'll give you our current list of service providers if you ask.
• with the integration partners a customer chooses to connect, such as Klaviyo, solely to operate that integration for the customer.
• with our group companies and affiliates, under this policy.
• with the parties involved if our business is ever part of a merger, financing, or sale, under confidentiality.
• where the law requires it, or to enforce our agreements and protect people's rights, safety, and property.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We haven't done either in the past 12 months. We do not share the contact or recipient information we process on our customers' behalf - including information received from connected tools such as Klaviyo - with any third party for that third party's own purposes, including marketing or advertising.

7. How long we keep it

We keep personal information for as long as we need it for the purposes in section 4, and then for as long as the law or a dispute requires. How long that is depends on the type of information, how you use the Service, and whether you've asked us to delete it. As a guide:

• Account and profile data: while your account is active, and for up to 2 years after it closes, so we can restore it if you come back and keep our records straight.
• Billing records: for as long as tax and accounting law requires, which is typically up to 7 years.
• Recipient and pass data we process for a customer: while the recipient's pass is active, and for up to 36 months after it becomes inactive, unless the customer asks us to delete it sooner. When a customer closes their account or asks us to delete a recipient, we delete that data within 30 days.
• Support and communications: for up to 3 years after the conversation ends.
• Usage, device and diagnostic logs: for up to 24 months, then deleted or de-identified.

If you ask us to delete your information, we'll do it within the timeframe the law gives us (see section 11). Once information is de-identified or aggregated so it no longer points to you, we may keep and use it indefinitely.

8. Cookies & tracking

We and our partners use cookies, SDKs, pixels, and similar technologies to keep you signed in, remember your preferences, measure performance, and support analytics and advertising. You can manage many of these through your browser or device settings, though some are needed for the Service to work.

9. Where it's stored

Our servers and databases are located in the European Union (Amsterdam, Netherlands), and our team works from the United States. That means your information may be stored and processed outside the United States. Wherever it is, it's protected by this policy and the security measures in section 10.

10. How we protect it

We use technical and organisational measures designed to protect your information, like encryption in transit (TLS) and encryption at rest, access controls with multi-factor authentication, and monitoring. That said, no method of sending or storing data is completely secure, so we can't promise perfection - and we'll always be straight with you if something goes wrong. If a security incident affects your personal information, we'll notify you and, where required, the relevant authorities within the legal timeframes.

11. Your choices & rights

Depending on the state you live in, you may have the right to:

• Know what personal information we've collected about you, where it came from, why we use it, and who we've shared it with, and get a copy of it.
• Correct it if it's wrong or incomplete.
• Delete it, subject to some exceptions (like records we have to keep by law).
• Take a copy elsewhere in a portable format.
• Opt out of the sale or sharing of your personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. We don't do any of these today, but if that ever changes you'll be able to opt out here.
• Limit our use of any sensitive personal information. We don't set out to collect any.
• Not be discriminated against for exercising any of these rights. Same service, same price.
• Appeal if we turn down a request, where your state gives you that right. We'll tell you how when we respond.

To make a request, email us at the address below - we won't make you jump through hoops. We'll confirm we've received it within 10 days and respond within 45 days, and we'll tell you if we need longer. We may need to verify your identity first, and you can use an authorised agent if you give them written permission. You can also opt out of marketing at any time using the link in our emails.

If your information was given to us by one of our customers (for example, you've added their pass to your wallet), please send your request to them, and we'll help them deal with it.

12. Children

The Service is built for businesses and isn't directed at children. We don't knowingly collect personal information from anyone under 13, and we don't knowingly sell or share the personal information of anyone under 16. If you think a child has given us data, let us know and we'll remove it.

13. Say hello

If anything here is unclear, or you want to exercise a right, email us at priority@lockscreen.ai or write to Lockscreen LLC, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. We're happy to help and we promise not to reply in legalese.