PRIVACY POLICY.

1. DATA WE PROCESS

We process account and order data you provide, including name, email, date of birth, locale, selected number, mode and order status. For security, we also process reasonable technical data such as sessions, IP address and browser user agent.

For manual payments we process reference, amount, proof and file metadata. For crypto payments we process network, token, payment address, transaction hash, amounts and optional proof. A blockchain hash can be publicly verifiable on its network.

We use Google Tag Manager and Google Analytics from Google LLC to manage technical tags and measure Lotty's use. When they load, Google may receive technical and navigation data, such as IP address, visited URL or action, referrer, and browser or device signals, depending on the configuration and your browser controls. We do not use them to send passwords, seed phrases, private keys or payment proofs.

2. PURPOSES

We use this data to create and protect accounts, calculate and record orders, validate payments, activate participations, publish results, handle requests, prevent fraud and meet operational or legal obligations.

We use technical measurement managed through Google Tag Manager and Google Analytics to understand Lotty's use and performance and improve it.

We do not sell personal data. We do not use private proofs for advertising. Publicly displayed market data does not identify a person.

3. RETENTION AND ACCESS

We retain data only for the time needed for the account, operation, security, dispute resolution and applicable obligations. Proofs are stored privately; the database retains their references and audit controls.

Access is role-limited. Proofs are available only to the authorized user or authorized administrative personnel when review is necessary.

4. PROVIDERS AND TRANSFERS

Lotty uses infrastructure to host the application, send email, store proofs, manage tags with Google Tag Manager, measure use with Google Analytics and query blockchain networks or market data. Those providers receive only the information needed to perform their function.

We do not control public chains: a transaction sent to a blockchain remains subject to that network's rules, visibility and permanence.

5. YOUR RIGHTS AND REQUESTS

You may request access, correction, updating or information about the processing of your data. Where law permits, you may also request deletion or object to certain processing.

To protect your account, we may request identity verification before handling a request. Deletion may be limited by records we must retain for security, payments, audit or compliance.

6. SECURITY AND CHANGES

We use session controls, encryption in transit, access restrictions, audit logs and measures designed to prevent unauthorized use. No Internet-connected system can promise zero risk, so you must also protect your email and password.

If we materially change this policy, we will update the date and content of this page.