Privacy Policy

1. Data Controller

Prixio LLC (Identification Code: 405842842), registered address: Tbilisi, Vake-Saburtalo District, Avto Varazi Street No. 107, Georgia (hereinafter, "we", "Company", "Data Controller"), operates the Lotify platform (hereinafter, "Platform"). We respect your privacy and are committed to protecting your personal data in accordance with the Law of Georgia on Personal Data Protection (2023).

2. Data Collection

2.1 Directly Provided Data

During registration and use of the Platform, we collect:

• Email address (legal basis: contract performance)
• Phone number (+995 format): optional for basic accounts, required for sellers (legal basis: consent/contract performance)
• First and last name (legal basis: contract performance)
• Username (legal basis: contract performance)
• Profile photo: optional (legal basis: consent)
• During seller verification: government ID photos (front and back), selfie, full name, phone number, city, address line, postal code (legal basis: legitimate interest in fraud prevention)
• Auction activity: listing details (title, description, photos, starting price, condition), bids placed, transactions completed (legal basis: contract performance)
• Payment data: payment transaction records, bank account details for seller payouts (legal basis: contract performance and legal obligation)
• Shipping data: delivery addresses, recipient contact information, tracking numbers (legal basis: contract performance)

2.2 Automatically Collected Data

• IP address (legal basis: legitimate interest in security)
• Browser type and version (legal basis: legitimate interest in service optimization)
• Device information (legal basis: legitimate interest in service optimization)
• Platform activity log including listing views, search queries, bid history (legal basis: contract performance)
• Push notification subscriptions (VAPID tokens), when you enable push notifications (legal basis: consent)
• Cookies and localStorage data for session management and preferences (legal basis: consent for non-essential)

3. Data Usage and Legal Basis

Your data is used for the following purposes with the corresponding legal basis:

• Account creation and authentication: contract performance
• Facilitating the auction process: contract performance
• Processing payment transactions: contract performance and legal obligation
• Seller verification: legitimate interest in fraud prevention
• Managing the trust and safety system: legitimate interest
• Sending service notifications: contract performance; marketing communications: consent
• Shill bidding and fraud prevention: legitimate interest
• Platform improvement and analytics: legitimate interest

4. Authentication & Security

The Platform uses Supabase's authentication system, which provides:

• Email and password authentication
• Google authentication (OAuth)
• Session management with JWT tokens
• Row Level Security (RLS) at the database level

Passwords are stored in hashed form and are never stored in plain text.

5. Cookies

The Platform uses the following cookies:

• Essential cookies: session management, authentication tokens, language preference (ka/en)
• Functional cookies: user preferences

We do not use advertising or tracking cookies. For detailed information, see our Cookie Policy.

6. Data Storage and Cross-Border Transfers

• Database: Supabase (PostgreSQL) with Row Level Security, encrypted at rest by the provider
• Listing photos and profile pictures: Supabase Storage, in public buckets. Anyone who has the file link can open the image without signing in, which is what lets listings be browsed publicly. Only you can upload, replace or delete your own files.
• Sessions: signed tokens issued by Supabase Auth and stored as cookies in your own browser
• Verification documents: Supabase Storage, in a private bucket. They are not publicly readable. Access is limited to you and to the administrators reviewing your application, through links that expire after one hour.

Cross-border data transfers: your data is stored on servers operated by Supabase (AWS infrastructure in EU and US regions), the website is served by Vercel and the API runs on Railway, both in the US. Transactional email is sent through Resend (US) and AI listing features use Google (US). Product analytics run on PostHog's EU cloud in Frankfurt, so that data does not leave the European Union, and the events reach PostHog through lotify.ge rather than straight from your browser. Card payments are processed by Bank of Georgia inside Georgia. These transfers are conducted in compliance with the Law of Georgia on Personal Data Protection, with appropriate safeguards for your data.

7. Automated Decision-Making

The Platform uses automated processing in the following cases:

• AI-powered listing generation: When you upload photos, Google Gemini AI analyzes them to suggest item titles, descriptions, and categories. You have the right to review, modify, or reject these suggestions before publishing.
• Fraud detection: Automated systems analyze bidding patterns to detect potential shill bidding. Flagged accounts are reviewed by human administrators before any action is taken.

You have the right to request human intervention, express your point of view, and contest decisions made solely through automated processing.

8. Your Rights

In accordance with the Law of Georgia on Personal Data Protection (2023), you have the following rights:

• Right of access: You may request a copy of the data stored about you.
• Right of rectification: You may request correction of inaccurate data.
• Right of erasure: You may delete your account and data from Settings, Account. Your identity documents and selfie, image files included, are destroyed immediately on request and are not restored if you recover the account. The account is deactivated at once and the remaining data is erased 30 days later. If an obligation is still live, such as an auction that already has bids, funds held in escrow, an auction you have won but not paid for, an open dispute or a payout we still owe you, the erasure waits for it to finish and then continues on its own. It is delayed, never refused. Financial records are kept for 6 years, as the Tax Code of Georgia and the Law on Accounting require.
• Right of portability: You may download a copy of your data at any time from Settings, Account. The export is a single JSON file covering your profile, listings, bids, purchases, sales, watchlist, questions, ratings and disputes.
• Right to object: You may object to the processing of your data based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to complain: You have the right to file a complaint with the State Audit Office of Georgia (pdp.sao.ge), which took over supervision of personal data protection from the Personal Data Protection Service on March 2, 2026, if you believe your data protection rights have been violated.

To exercise these rights, contact: contact@lotify.ge

9. Third Parties

The following third parties process personal data on our behalf or receive it in order to deliver part of the service:

• Supabase (USA and EU, AWS infrastructure): authentication, the database, and file storage. This is where your account, listings, bids and uploaded files are held.
• Bank of Georgia (Georgia): card payment processing. We send the order amount, the currency and our own order reference. Your card details are entered on the bank's own payment page and never reach our servers.
• Resend (USA): delivery of transactional email. Receives your email address and the content of the message, for example an outbid alert or a payment reminder.
• Google (USA): AI listing features. Photos you upload to a listing are sent to Google's Gemini model to draft the listing text, and uploaded images may also be sent to Google's image analysis service for automated content checks. If the primary model is unavailable, the same photos may be sent to OpenAI (USA) as a fallback.
• Courio Courio (Georgia) and OpenStreetMap (European Union): courier booking and address lookup. This integration is built but switched off, so no delivery address is sent to either of them. Today the seller books the carrier themselves and only records the tracking number on the Platform.
• PostHog (European Union, Frankfurt): product analytics. It receives page views, clicks and other interaction events, which we use to find and fix problems in the interface. Those events are sent to lotify.ge and passed on from our own server, so your browser never connects to a PostHog address directly. The data is held in PostHog's EU region and is not transferred outside it. Session recording is not switched on, so no recordings of your browsing are made. Card details are entered on the bank's own payment page, never reach the Lotify front end, and so are never captured.
• Vercel (USA): hosting for the website. Receives the requests your browser makes, including your IP address, plus cookieless page performance measurements.
• Railway (USA): hosting for our application server. Processes API requests and holds the server logs they generate.
• Upstash (global): rate limiting counters. Holds short-lived counts keyed to an IP address and a route, so that sign-in, registration, bidding and upload requests cannot be repeated abusively. No account content is stored there.
• Browser push services (Google, Mozilla, Apple): if you turn on push notifications, your browser issues a subscription address and we send notifications through the service that issued it.

We do not sell or share your personal data for marketing purposes.

Cross-border data transfers are conducted in accordance with Article 37 of the Law of Georgia on Personal Data Protection. Where a recipient is outside Georgia, the processing is covered by that provider's data processing agreement. Our data register lists each recipient and where it holds the data.

10. Data Retention Period

• Profile data: for as long as the account is active. If you delete your account it is deactivated at once, and the data is erased 30 days later, or as soon after that as any auction, payment or dispute still open on the account has finished.
• Transaction and financial records: 6 years (in accordance with Georgian tax legislation, the Tax Code of Georgia)
• Verification documents: 1 year from completion of verification
• Session tokens: held in your browser until you sign out or the token expires
• Audit records of administrative actions and escrow transactions: kept indefinitely as part of the transaction record. There is no automatic deletion for them.

11. Minors

The Platform is intended for persons aged 18 and over. We do not collect a date of birth, so we cannot verify a user's age at registration. If you become aware that a minor has registered on the Platform, please contact us and we will close the account.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• All data is transmitted using TLS/SSL encryption (HTTPS)
• Database-level Row Level Security (RLS) ensures users can only access their own data
• Administrative actions taken on user data are recorded in an audit log
• Strict access controls limit employee access to personal data on a need-to-know basis
• Rate limiting on sign-in, registration, bidding, and upload endpoints to limit automated abuse

13. Policy Changes

We may update this Privacy Policy from time to time. The revision date is shown at the top of this page and material changes are published here. We do not currently send policy update emails, so please check this page periodically.

14. Contact

For privacy-related questions, contact us at contact@lotify.ge

For full contact details, visit our Contact page

Prixio LLC (Identification Code: 405842842)

15. Supervisory Authority

If you believe that the processing of your personal data violates Georgian legislation, you have the right to file a complaint with: