Privacy Policy

Last updated: June 17, 2026

1. Who We Are

LockBuzz (“we,” “us,” “our”) operates a wallet pass notification platform at lockbuzz.io. Our registered address is [ADDRESS]. For privacy inquiries: privacy@lockbuzz.io.

2. Who This Policy Covers

This policy covers two distinct groups:

• Brands — businesses that create LockBuzz accounts to send notifications to their audience.
• Subscribers — individuals who install a brand’s LockBuzz wallet pass. Subscribers are not required to create an account or share any personally identifiable information with LockBuzz.

3. Information We Collect

Brand Accounts

Wallet Pass Subscribers

Important: LockBuzz does not collect Subscribers’ names, email addresses, phone numbers, or location data. Subscriber records are pseudonymous by design.

4. How We Use Information

We use Brand account data to:

• Deliver the LockBuzz platform and send service communications
• Process billing and maintain financial records
• Provide customer support
• Improve the platform and detect abuse

We use Subscriber pass data to:

• Maintain wallet pass infrastructure (pass updates, gamification state)
• Enable Brands to send push notifications to their Subscribers
• Calculate engagement metrics displayed to Brands

We do not use Subscriber data for advertising, cross-context profiling, or any purpose outside delivering the pass notification service the Subscriber opted into.

5. Legal Basis for Processing (GDPR)

For EU/UK residents, our legal bases are:

• Brand account data: performance of a contract (your LockBuzz subscription agreement)
• Subscriber pass data: legitimate interests of the Brand as data controller (operating a pass notification channel the Subscriber opted into)
• Billing data: legal obligation (financial and tax record-keeping requirements)
• Security and fraud prevention: legitimate interests of LockBuzz

6. Data Sharing and Sub-processors

We do not sell personal data. We share data only with the following sub-processors necessary to operate the service:

We do not share Brand account data with other Brands or with third parties for advertising purposes.

7. Subscriber Data Exports

Brands may export their Subscriber data via the Settings panel. Exported records are pseudonymous (UUID-keyed, no PII). Brands who export data must handle it in accordance with applicable privacy law and in compliance with our Terms of Service and Data Processing Addendum. Exported data may not be combined with external personally identifiable information without a separate lawful basis, and may not be used for advertising, resale, or any purpose outside the Brand’s own LockBuzz channel.

8. Data Retention

• Brand account data: retained while your account is active, plus 30 days after account deletion
• Active Subscriber records: retained while the pass is installed
• Unsubscribed Subscriber records: deleted within 90 days of pass removal
• Pause plan accounts: Subscriber data retained for up to 12 months of inactivity, with a 60-day advance notice before auto-deletion

9. Your Rights

EU/UK Residents (GDPR)

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (right to erasure)
• Restrict or object to processing
• Receive a portable copy of your Brand account data
• Lodge a complaint with your local supervisory authority

Brands can fulfill Subscriber erasure requests via Settings › Danger Zone › Delete Subscriber by ID. For Brand account rights, contact privacy@lockbuzz.io.

California Residents (CCPA/CPRA)

You have the right to:

• Know what personal information we collect and how we use it
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioural advertising
• Non-discrimination for exercising your privacy rights

10. Security

We implement industry-standard security measures including TLS 1.2+ encryption in transit, AES-256 encryption at rest, row-level security at the database layer, and access controls restricting data to authorised Brand accounts. No security measure is absolute; we cannot guarantee that data will never be accessed in an unauthorised way.

In the event of a data breach affecting personal data, we will notify affected Brand accounts and relevant supervisory authorities as required by applicable law (within 72 hours under GDPR where feasible).

11. Children’s Privacy

Brand accounts require users to be 18 or older. The wallet pass install experience is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, contact privacy@lockbuzz.io and we will delete it promptly.

12. International Transfers

Data may be transferred to and processed in the United States and other countries in connection with our sub-processors. Transfers of EU/UK personal data to third countries are made under appropriate safeguards, including EU Standard Contractual Clauses where required.

13. Changes to This Policy

We will post updates to this policy on this page and update the “Last Updated” date. Material changes will be communicated to Brand account holders via email at least 14 days before they take effect.

14. Contact

Privacy inquiries: privacy@lockbuzz.io

GDPR-specific requests: email the above with subject line “GDPR Request”

CCPA-specific requests: email the above with subject line “CCPA Request”