Privacy Policy

1. Introduction

Prixio LLC (Identification Code: 405842842) operates the Lotify platform (the Platform) and is the data controller for the personal data described here. In this policy, we means Prixio LLC. This policy explains what we collect, why, who receives it and what rights you have under the Law of Georgia on Personal Data Protection.

The Georgian text of this policy prevails. The English text is a convenience translation.

2. Data We Collect

2.1 Data You Give Us

When you register and use the Platform, we collect:

• Email address
• Phone number (+995 format): optional for basic accounts, required to sell
• First and last name
• Username
• Profile photo: optional
• For seller verification: photos of your ID (front and back), a selfie, full name, phone number, city, address and postal code
• Auction activity: listing details (title, description, photos, starting price, condition), bids, questions, ratings and completed sales
• Seller account details: your international bank account number (IBAN), the account holder name, your statement that the account is your own GEL account, the result of our name check, and a history of changes to these details
• Seller status: whether you sell as a private person or as a trader and when you stated it, and for a trader the business name, address and contact email
• Delivery data: delivery address, recipient name and phone number, and the tracking number the seller records
• Dispute data: what you write in a dispute and any evidence you submit
• Acceptance and consent records: which version of the Terms and this policy you accepted, your decisions on consents, when you made them, the language and the place in the Platform where you made them

2.2 Data Collected Automatically

• IP address and browser details stored with each bid
• Browser type and version, in server requests and logs
• Device details, in server requests and logs
• Listing views: the listing, your account if you are signed in, and a hash of your IP address that changes daily. Search queries are not recorded.
• Push notification subscription address, if you turn on push notifications
• Cookies and browser local storage, as described in section 5 and in our Cookie Policy

2.3 Data From Other Sources

• Google: your name, email address and profile photo, if you sign in with Google
• Bank of Georgia: the payment receipt for your order, including the bank's transaction number and result code
• Other users: what they write about you in ratings, questions, reports and disputes

2.4 What Is Required and What Happens If You Refuse

• To create an account you must give the account data in section 2.1. Without it we cannot register you.
• To sell you must give a phone number, verification data, your seller status and an IBAN. Without them you cannot sell, or the amount for your sale cannot be captured.
• To receive an item by delivery you must give delivery data. Without it the seller cannot send the item.
• A profile photo, push notifications, AI listing help and analytics are optional. Refusing them does not stop you buying or selling. Written consent to transfers to the USA is also voluntary, and section 11 explains what is unavailable without it.

3. Why We Use Data and Our Legal Grounds

We use your data for the purposes below. Each purpose names its legal ground under the Law of Georgia on Personal Data Protection.

• Creating your account and signing you in. Ground: performing our contract with you.
• Running auctions, bids and sales. Ground: performing our contract with you.
• Telling buyers who is selling and which rights they have. Grounds: performing our contract with you, and legal duties placed on us by Georgian legislation.
• Placing, capturing and cancelling card holds, and transferring the seller's share to the seller's IBAN. Grounds: performing our contract with you, and legal duties placed on us by Georgian legislation.
• Verifying sellers and checking that an IBAN belongs to the seller. Ground: our significant legitimate interest in preventing fraud.
• Calculating trust scores and applying the limits linked to them. Ground: our significant legitimate interest in keeping the Platform safe.
• Sending service notifications about your account, bids, sales and disputes. Ground: performing our contract with you. Marketing is covered separately in section 13.
• Detecting bids by a seller on the seller's own lot, and other fraud. Ground: our significant legitimate interest in preventing fraud.
• Improving the Platform through product analytics. Ground: your consent, given in the cookie banner.
• AI help with listing text, only if you choose that feature. Ground: your consent, which we record before first use and which you can withdraw in Settings, Account.
• Finding and fixing errors and keeping the service running. Ground: our significant legitimate interest in operating the service securely.
• Recording what you accepted or refused and which change notices we sent you. Ground: our significant legitimate interest in being able to show this.

Where we rely on a legitimate interest, the interest is the one named above: preventing fraud, keeping the Platform safe, operating it securely and being able to show what you accepted. You may ask us to stop this processing, as section 8 explains.

4. Sign-In and Account Security

The Platform uses Supabase's authentication system, which provides:

• Sign-in with email and password
• Sign-in with Google. This is the only social sign-in we offer.
• One-time codes sent by text message, where phone sign-in or phone confirmation is used
• Session management with signed tokens
• Row Level Security at database level

Passwords are stored in hashed form and never in plain text.

5. Cookies

The Platform uses the following cookies:

• Essential cookies: sign-in session and language preference.
• Analytics cookies: PostHog cookies, set only if you accept analytics in the cookie banner.

We do not use advertising cookies, and we do not use cookies to follow you across other websites. For details, see our Cookie Policy.

6. Where Data Is Stored

• Database: Supabase (PostgreSQL) in Frankfurt, with Row Level Security, encrypted at rest by the provider.
• Listing photos and profile pictures: Supabase Storage, in public storage. Anyone who has the file link can open the image without signing in, which is what lets listings be browsed publicly. Only you can upload, replace or delete your own files.
• Sessions: signed tokens issued by Supabase Auth and kept as cookies in your own browser.
• Verification documents: Supabase Storage, in private storage. Access is limited to you and to the administrators reviewing your application, through links that expire after one hour.

Section 11 lists the recipients outside Georgia.

7. Automated Decisions

Some steps on the Platform are decided by software. These are the cases that can affect you:

• Card hold. After the bank places a hold, our system asks the bank to capture or cancel it under fixed rules, without a person reviewing the case. The amount is captured when the buyer confirms receipt, or on day 9 after the hold if no dispute is open, whichever comes first. The hold is cancelled and the buyer is not charged if the seller misses the dispatch deadline, if a dispute is still open on day 9, or if the seller's IBAN is not verified by day 9. Delivery status is recorded by the seller, is not verified by Lotify and does not trigger capture.
• Bid checks. After each bid, software compares the bidder with the seller and compares the bidder's IP address with IP addresses from the seller's bids in the last 90 days. A match creates a flag with a risk score for an administrator. The check does not affect whether the bid succeeds, and any action on a flag is taken by an administrator.
• Trust score. Software calculates a score from account age, seller verification, successful sales, lost disputes and non-payment marks. The score sets your trust level automatically, except the highest level, which an administrator assigns. The level sets how many active auctions you may run and how many images a listing may have. Your score and level are visible on your public profile.
• Non-payment. If you do not pay for an auction you won, the system records a mark against your account. At three active marks, bidding is restricted automatically for 30 days.
• IBAN check. Software compares the account holder name with your verified identity and checks that no other seller uses the same IBAN. If both checks pass, the IBAN is verified automatically. If not, it goes to an administrator. The amount for a sale can be captured only to a verified IBAN.
• Image checks. Software checks each uploaded image and may reject it automatically, for example if it looks like a stock photo or fails technical checks. No person reviews a rejection unless you ask.
• AI listing help. If you choose this feature, an AI model suggests a title, description and category from your photos. It is only a suggestion: you can change or reject it before publishing.

You have the right not to be subject to a decision made only by automated means, including profiling, that has a legal or similarly significant effect on you, except where the law allows it. You may write to us to ask a person to review such a decision, to give your view and to contest it. A review request does not stop a payment deadline. Only a dispute opened before capture does that.

8. Your Rights

Under the Law of Georgia on Personal Data Protection, you have the following rights:

• Right to information: You may ask what data we process about you, why, on what ground and who receives it.
• Right to see your data and receive a copy: You may ask to see the data we keep about you and to receive a copy.
• Right to correct, update and complete your data: You may ask us to correct inaccurate data and to update or complete it.
• Right to stop processing, erase or destroy your data: You may delete your account and data from Settings, Account. Your identity documents and selfie are destroyed as soon as you ask, and are not restored if you recover the account. The account is deactivated at once, and the remaining data is erased 30 days later. Erasure waits for live obligations to finish, such as an auction of yours that has bids, an auction where you are the highest bidder, an auction you won but have not paid for, a card hold not yet captured or cancelled, a payment in progress or an open dispute. At erasure, your live auctions with no bids are cancelled. Some records stay after erasure, as section 12 explains.
• Right to block your data: You may ask us to block your data in the cases the law provides.
• Right to transfer your data: You may download a copy of your data at any time from Settings, Account. The export is a single JSON file covering your profile, seller status, listings, bids, purchases, sales, watchlist, questions, ratings and disputes.
• Right to ask us to stop legitimate interest processing: You may ask us to stop processing your data where we rely on a legitimate interest.
• Rights on automated decisions: See section 7.
• Right to revoke consent: Where processing is based on consent, you may revoke it at any time. This does not affect processing already carried out. You withdraw consent to transfers to the USA and to AI listing help in Settings, Account.
• Right to complain: If you believe your rights have been violated, you may apply to the State Audit Service or to a court. See section 18.

We answer requests within 10 working days. In special cases we may extend this by up to 10 more working days, and we will tell you why.

To exercise these rights, contact: contact@lotify.ge

9. Who Receives Your Data

The companies below process personal data for us or receive it to deliver part of the service. The website named for each company is its contact point.

• JSC Bank of Georgia (Georgia, bankofgeorgia.ge): card holds, payment and transfer of the seller's share. When an order is created we send the order reference, amount, currency, listing ID and redirect URLs. When an amount is captured we send the seller's IBAN, the seller's share and a description containing the listing ID. The bank sends us a payment receipt with its transaction number and result code. Card details are entered on the bank's own page and never reach our servers.
• Supabase (European Union, Frankfurt; US company; supabase.com): authentication, database and file storage. Your account, listings, bids and uploaded files are kept here. Where text message codes are used, Supabase Auth sends them through its text message provider.
• Resend (USA, resend.com): delivery of email. Receives your email address, your name and the content of the message, for example an outbid alert or a payment reminder.
• Google (USA, google.com): AI listing help. If you choose this feature, up to three listing photos are sent to the Gemini model to draft listing text.
• Google sign-in (USA, google.com): sign-in with Google, if you choose it. Google tells us your name, email address and profile photo, and learns that you signed in to Lotify.
• Google Cloud Vision (USA, google.com): automated image checks, only where this service is switched on. Listing photos and profile photos you upload are sent to it to check for stock images and unsuitable content.
• OpenAI (USA, openai.com): standby for AI listing help, only where this service is switched on and the main model is unavailable. It would receive the same photos.
• PostHog (European Union, Frankfurt; US company; posthog.com): product analytics, only if you accept analytics in the cookie banner. Receives page views, clicks, other interaction events and browser errors. Events go to lotify.ge first and are passed on from our own server. Session recording is not switched on. Card details never reach the Lotify website, so they are never captured.
• Vercel (USA, global network; vercel.com): website hosting. Receives the requests your browser makes, including your IP address, and page performance measurements that use no cookies. Requests pass through the nearest point of its global network, and page rendering currently runs in the USA.
• Railway (US company, railway.com): application server hosting. Processes API requests and keeps the server logs they generate.
• Upstash (US company, global locations; upstash.com): request rate counters. Keeps short-lived counts tied to an IP address and a route, so that sign-in, registration, bid and upload requests cannot be repeated abusively. No account content is kept there.
• Sentry (not yet fixed, treated as USA; sentry.io): error tracking, only where this service is switched on. Receives error reports with technical details, your account identifier and limited browser details. Emails, phone numbers, tokens, cookies, request contents and query strings are removed first. It sets no cookies and records no sessions.
• Browser push services (Google, Mozilla, Apple): if you turn on push notifications, your browser issues a subscription address and we send notifications through the service that issued it.
• Public authorities and courts: we disclose data when the law requires it, for example at the request of the tax authority, a court or the State Audit Service.

We do not sell your personal data.

10. What Other Users See

• Public profile: anyone can see your username, display name, profile photo, seller rating, number of auctions, successful sales, trust level and score, whether you completed seller verification, and when you joined.
• Listings: anyone can see your listings, their photos, and public questions and ratings.
• Bids: other users see the amount, the time and a masked form of the bidder's name.
• After a sale, the seller sees the buyer's name, phone number and delivery address, so that the item can be sent.
• After a sale, the buyer sees the seller's tracking number and delivery status. For self-pickup, the buyer sees the pickup address and phone number the seller entered.
• Seller status: anyone viewing your listings sees whether you have stated that you sell as a private person or as a trader. If you are a trader, the business name, address and contact email you enter are published to buyers on your listings, in the bid confirmation step and at payment, and are sent to the winner by email.
• We do not show your account email address or your IBAN to other users. A private seller's address and email are not published.

11. International Transfers

The table shows where each recipient is located and what your data's transfer rests on. The law allows a transfer to a country on the list of countries with appropriate safeguards. For other countries, it allows other routes, including a contract with a State Audit Service permit, or your written consent after you are told of the risks.

For the United States, we have no State Audit Service permit. We ask for your written consent after telling you the risks, record your decision with its version and time, and you can give or withdraw it at any time in Settings, Account. Without this consent you cannot place new bids, publish new listings or accept second-chance offers, and optional email stops. You can still browse, manage your account, use your rights and complete existing purchases and sales. Withdrawing does not affect transfers already made or sales already concluded. Some transfers do not depend on this decision: the website and server hosting (Vercel, Railway), request rate counters (Upstash), and email needed for your purchases, sales, disputes, account security and legal notices (Resend) continue whatever you decide, because the Platform cannot run without them. You can ask us about any transfer at contact@lotify.ge.

12. How Long We Keep Data

We keep data only as long as its purpose needs. Where the table gives criteria instead of a fixed period, no automatic deletion is set, and we keep the data for as long as those criteria apply.

13. Marketing

We send marketing messages only with your separate consent. Consent is not a condition of using the Platform, and you may revoke it at any time. We do not currently send marketing campaigns. The email setting in Settings controls non-critical notification emails, such as outbid alerts. We do not treat it as marketing consent.

14. Minors

The Platform is intended for persons aged 18 and over. We do not collect a date of birth, so we cannot verify a user's age at registration. If you learn that a minor has registered, please contact us and we will close the account.

15. Data Security

We use technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration or destruction:

• All data is transmitted over encrypted connections (HTTPS)
• Row Level Security in the database limits which records each user can reach
• Administrative actions on user data are recorded in an audit log
• Administrator access is based on roles
• Rate limits on sign-in, registration, bid and upload requests, to limit automated abuse

16. Changes to This Policy

We may update this policy. The revision date is shown at the top of this page, and changes are published here. We notify you by email and on the Platform at least 15 days before a new version takes effect, and at least 30 days before a version that reduces your rights. We record which version you accepted and when.

17. Contact

For privacy questions, contact us at contact@lotify.ge

For full contact details, visit our Contact page

Prixio LLC (Identification Code: 405842842)

18. Supervisory Authority

If you believe that the processing of your personal data violates Georgian law, you may apply to: