LOLO PRIVACY POLICY

1. Delete your account and contact us to request deletion of your data; and
2. Delete the App from your devices.

• Account and Registration Data: name, nickname, email address, profile photo, gender, date of birth, login credentials (including Apple ID, Google ID, or Facebook ID), and any optional profile details you choose to provide.


• Communication Data: messages exchanged within the Service, correspondence with our support team, dispute resolution data, and notifications preferences. Screenshots may occasionally be taken for moderation or fraud-prevention purposes.


• Device and Technical Data: IP address, time zone, device model, operating system, language settings, hardware identifiers (e.g., IDFA, AAID, IDFV), crash logs, network information, and performance data.


• Usage Data: logs of how you interact with the Service (e.g., pages or features used, time spent, frequency of logins, in-app actions, search queries, and referral source such as the app store or ad that brought you to the Service).


• Location Data: approximate location derived from your IP address or device settings. We do not collect precise GPS location unless you explicitly allow it.


• Payment and Transaction Data: transaction IDs, purchase history, subscription or in-app purchase confirmations through Apple App Store or Google Play. We do not store full payment card details; payments are processed securely by Apple or Google.


• Advertising and Analytics Data: advertising identifiers (IDFA, AAID), cookies, and tracking pixels (including Meta Pixel), which may collect data about your interactions with the Service, ads you see, and actions you take.


• Verification Data (where required for compliance or fraud prevention): identity documents, selfies for age verification, and associated metadata.

5.1. We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, accounting, or reporting obligations.
5.2. If you delete your account, we will remove or anonymize your data according to the following timelines:

• Account/profile data: deleted within 30 days of account deletion.


• Communications (messages, correspondence, attachments): deleted within 30 days of account deletion.


• Moderation and safety logs (e.g., flagged content, screenshots, abuse reports): retained for up to 60 days for fraud prevention and platform safety, then permanently deleted or anonymized.


• Technical logs and device information: deleted or anonymized within 60 days, unless longer retention is required for security or legal investigations.


• Payment and transaction data: retained as required by applicable tax and accounting laws (typically 5–7 years).

5.3. Where precise retention periods cannot be determined in advance, we will apply the shortest necessary period consistent with the purposes outlined in this Policy.
5.4. After the retention period expires, we will securely delete or anonymize your Personal Data so that it can no longer be associated with you.

6.1. Under applicable data protection laws (including GDPR and CCPA), you have the following rights:

• Right of access: to request confirmation of whether we process your data and obtain a copy.


• Right to rectification: to have inaccurate or incomplete data corrected.


• Right to erasure (“right to be forgotten”): to request deletion of your data, subject to legal obligations.


• Right to object: to object to processing based on legitimate interests, including direct marketing.


• Right to restrict processing: to request suspension of processing under certain conditions.


• Right to data portability: to obtain your data in a structured, machine-readable format and transfer it to another controller.


• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.


• Right to lodge a complaint: with your local data protection authority if you believe we unlawfully process your data.

6.2. To exercise your rights, please contact us at [email protected]. We may request verification of your identity before responding to ensure the security of your data.
6.3. We will respond to verified requests within 30 days or, where allowed by law, within a maximum of 60 days.
6.4. Access rights under California’s Shine the Light California also provides its residents with additional access rights. Under Shine the Light law, the residents may ask companies once a year what personal information they share with third parties for those third parties' direct marketing purposes. Learn more about what is considered to be personal information under the statute.

To obtain this information from us, please send an email message to [email protected], which includes “Request for California Shine the Light Privacy Information” on the subject line and your state of residence and email address in the body of your message. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing will be included in our response.

8.1. We operate globally and may transfer your Personal Data outside the country where it was originally collected.

• The European Commission has issued an adequacy decision for the destination country; or


• We have implemented Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring equivalent safeguards.

8.3. By using the Service, you acknowledge that your data may be transferred, stored, and processed in countries that may not have the same level of protection as your home jurisdiction, but always with appropriate safeguards.