Skip to content
Back to Lottevo

Legal & policies

Privacy Policy

What personal data Lottevo collects, why, who receives it, how long it is kept and how to exercise your rights.

Effective from Version 5

1. Who is responsible for your data

The controller of your personal data is BLĂJAN ADRIAN-ȘTEFAN PERSOANĂ FIZICĂ AUTORIZATĂ (BLĂJAN ADRIAN-ȘTEFAN PFA), CIF 53035590, Trade Register number F2025049307002, with its registered office at Str. Teilor 21E, Florești, Cluj, Romania ("Lottevo", "we", "us"). For anything about your data, write to contact@lottevo.com. We have not appointed a data protection officer, as the law does not require one for our activity.

This policy covers lottevo.com, the workspace, the Data API and the widgets. It does not cover the lottery data the Service delivers, which is about games and draws, not about people.

2. What we collect, why, and for how long

Your account

  • Data: first and last name, email address, password if you set one (stored only as a one-way hash), country, phone number if you give it, preferred language and time zone, the version and time you accepted the Terms of Service, and whether you agreed to receive product news.
  • Why: to create and run your account, sign you in and contact you about the Service.
  • Legal basis: the contract with you (article 6(1)(b) GDPR); product news only with your consent (article 6(1)(a)), which you can withdraw at any time from your workspace settings.
  • Kept: for as long as the account exists.

Signing in and security

  • Data: the sessions and devices signed in to your account, with their IP address and browser description (user agent), the time and IP address of your last sign-in, the time of your last activity, your two-factor authentication settings, and password reset requests.
  • Why: to keep your account secure, show you where you are signed in, let you sign out other devices and know when the account was last used.
  • Legal basis: our legitimate interest in securing the Service and your account (article 6(1)(f)), and the contract.
  • Kept: a session, with the address and browser it recorded, is deleted when you sign out, or within a day of expiring after 30 days without use; the time and IP address of your last sign-in and the time of your last activity are kept for as long as the account exists, each new sign-in replacing them; a two-factor sign-in challenge expires after 5 minutes.

Signing in with Google

  • Data: if you sign in or create an account with Google, Google sends us, in a signed token, your Google account's identifier, your email address, whether Google has verified it, and your name. We keep the link between your Lottevo account and the Google identifier, together with the email address. We never receive your Google password and have no access to anything else in your Google account.
  • Why: to sign you in without a password and to create your account with its email address already verified.
  • Legal basis: the contract (article 6(1)(b)); quick sign-in (One Tap), which Google offers you on any page, only with your consent (article 6(1)(a)), given in the cookie banner.
  • Kept: the link, for as long as the account exists or until you remove it from your workspace's security settings. The details of a Google sign-up you do not finish expire after 30 minutes and are deleted within a day.
  • What Google learns: when you press "Continue with Google", a Google window opens; and if you accept One Tap, Google's script loads on our pages while you are not signed in. Either way, Google's servers receive your IP address, the fact that you came from lottevo.com and Google's own cookies. Google processes this data as an independent controller, under its privacy policy.

Using the API

  • Data: for each request made with your API keys: the key, method, route and path, status, duration, any error, the IP address it came from and the user agent. We also keep daily totals of requests per key and route, which contain no IP address. Your keys themselves are stored only as a hash.
  • Why: to deliver the Service, enforce your plan's quotas, show you your request log and usage, and detect abuse.
  • Legal basis: the contract, and our legitimate interest in preventing abuse (article 6(1)(f)).
  • Kept: individual requests for 30 days; daily totals for 400 days.

Webhooks

  • Data: the endpoint URLs you register and the record of each delivery: the event sent and your server's response.
  • Why: to deliver events, retry failed deliveries and show you their history.
  • Legal basis: the contract.
  • Kept: delivered events for 30 days, other deliveries for 90 days.

Billing and payments

  • Data: the name or company name on your invoices, billing address, VAT number and the result of its VIES check, your subscriptions, invoices, proformas and credit notes, and for consumers, the date and time you asked for access to start immediately. Card and bank details are entered on Stripe's pages, not ours: we only receive the type of payment method and the last four digits of the card or account.
  • Why: to take payments, issue invoices and meet our tax and accounting obligations.
  • Legal basis: the contract, and our legal obligations under Romanian tax and accounting law (article 6(1)(c)).
  • Kept: for as long as Romanian tax and accounting law requires, even after the account is closed.

Support requests and the contact form

  • Data: your message, your contact details (from your account, or the name and email address you type in the contact form), the browser description, the page you wrote from, and the details of a logged API request if you attach one.
  • Why: to answer you and solve the problem.
  • Legal basis: the contract, and our legitimate interest in answering questions about the Service.
  • Kept: for as long as the account exists. A message sent from the contact form without an account is deleted 24 months after it was sent.

Emails we send

We send the emails the Service needs: address verification, password resets, payment and invoice notices, trial, usage, key-expiry and webhook alerts, support confirmations, and important changes to the Service or to these documents. We send product news only if you opted in.

Visiting the website

Our web servers record technical data about each request (IP address, page requested, time and browser description) to keep the site secure and fix problems. These logs are kept for a limited period and are not used to profile you. The cookies the website uses are listed in the Cookie Policy; we use no advertising cookies.

Website analytics

  • Data: only if you accept analytics cookies: the pages you visit and the page you came from, without their query, campaign tags in the link, the type of device, browser and operating system, an approximate location derived from your IP address, how you use the page (such as how long you stay), and the identifier Google Analytics keeps in its _ga cookie. Google Analytics does not log or store your IP address.
  • Why: to understand how the website is used and make it better.
  • Legal basis: your consent (article 6(1)(a) GDPR), which you give in the cookie banner and can withdraw at any time from Cookie settings at the bottom of every page.
  • Kept: 14 months in Google Analytics; the cookies last 2 years unless you withdraw your consent or delete them.

3. Who receives your data

We do not sell personal data and do not share it for advertising. We use these service providers, each only for its own task:

  • Stripe Payments Europe, Ltd. (Ireland): card, SEPA Direct Debit and bank transfer payments, subscriptions and the billing portal.
  • Oblio Software S.R.L. (Romania): issuing invoices, proformas and credit notes, and emailing them to you.
  • Cloudflare, Inc. (United States): Turnstile, the check on the sign-up form that tells people from automated sign-ups. It receives your IP address and technical details of your browser, only when you sign up.
  • Google Ireland Limited (Ireland): Google Analytics, only if you accept analytics cookies, and signing in with Google, if you use it or accept quick sign-in.

We also pass data to public authorities where the law requires it: invoices for customers in Romania go to the National Agency for Fiscal Administration (ANAF) through e-Factura, and VAT numbers are checked against the European Commission's VIES service.

4. Transfers outside the European Economic Area

We keep your data in the European Union. Stripe may process payment data in other countries, including the United States, within its group, Cloudflare processes the sign-up check in the United States, and Google may process analytics and sign-in data in the United States. They do so under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

5. Your rights

You have the right to:

  • access the personal data we hold about you and get a copy;
  • rectify inaccurate data — most of it you can change yourself in your workspace;
  • erase your data, except what we must keep by law;
  • restrict how we use it while a request is being handled;
  • port the data you gave us, in a structured, machine-readable format;
  • object to processing based on our legitimate interest;
  • withdraw consent at any time, without affecting processing done before.

To use any of them, write to contact@lottevo.com from the email address of your account. We answer within one month, and may ask you to confirm your identity first.

You can also complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at www.dataprotection.ro, or to the supervisory authority of the EU country where you live or work.

6. Security

Passwords and API keys are stored only as one-way hashes, and a full API key is shown once, when it is created. The session that keeps you signed in is held in a cookie scripts cannot read. You can turn on two-factor authentication and see and end your sessions from your workspace.

7. Automated decisions and minors

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. The Service is not meant for people under 18, and we do not knowingly collect their data.

8. Changes to this policy

When we change this policy, we publish the new version here with its date, and tell you by email or in your workspace if the change is significant.