1. Information We Collect
When you create a LottoBot account at lottobot.ai, we collect only what is necessary to operate your account:
- Email address — required for account access, password reset, and transactional notifications.
- Password hash — for email/password accounts. Stored as a non-reversible bcrypt hash. We never see or store your plaintext password.
- OAuth provider + provider user ID — if you sign in with Google or Facebook, we store the provider name and the stable identifier they issue for you. We do not store your profile photo.
- Consent timestamp — the date and time you agreed to this Privacy Policy and the Terms of Use.
- API key usage data — request counts, timestamps, draws used. API keys are stored only as SHA-256 hashes; the plaintext key is shown to you once and never stored.
- Basic site analytics — page views and referrers via Google Analytics 4 (property G-5GTVZPH2X5).
- Server logs — IP address and user agent retained in nginx access logs for abuse prevention, rotated within 14 days.
2. Lawful Basis for Processing
We process your personal data on two bases recognized under RA 10173 §12: (a) your affirmative consent, captured by the checkbox on the signup form; and (b) contractual necessity, where processing is required to deliver the service you requested (e.g. authenticating you, enforcing API rate limits).
3. How We Use Your Information
- To authenticate you and operate your account.
- To enforce API rate limits and usage quotas.
- To send transactional email (account creation, password reset).
- To improve the service through aggregated, anonymized analytics.
- To detect and prevent abuse, fraud, and security incidents.
We do not sell, rent, or trade your personal data. We do not use your personal data for advertising targeting.
4. Third-Party Processors
LottoBot relies on the following third-party services. Each has its own privacy policy that also applies to data they receive.
- Google — OAuth sign-in, Google Analytics 4 (G-5GTVZPH2X5), Google AdSense (publisher ca-pub-3392449098044156).
- Meta / Facebook — OAuth sign-in (when enabled), Facebook Page tooling for our public posts.
- Resend — transactional email delivery.
- DigitalOcean — cloud hosting (Singapore region).
5. Data Retention
- Account data — retained while your account is active.
- API usage logs — up to 12 months for security and abuse prevention.
- Server access logs — rotated within 14 days.
- After account deletion, all personal data is permanently removed within 30 days, except where retention is required by law.
6. Your Rights as a Data Subject
Under RA 10173 §16 you have the right to:
- Be informed about the processing of your personal data.
- Access the personal data we hold about you.
- Correct inaccurate or outdated data.
- Object to processing or withdraw consent.
- Erase your account and associated personal data — see Data Deletion.
- Receive a copy of your data in a portable format.
- Lodge a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated.
To exercise any of these rights, email [email protected].
7. Escalation to the National Privacy Commission
If you are not satisfied with our response to a data privacy concern, you may file a complaint with the National Privacy Commission of the Philippines: privacy.gov.ph · [email protected].
8. Cookies
We use essential cookies for session management (keeping you signed in) and security (CSRF protection). Third-party analytics cookies may be set by Google. You can disable cookies in your browser settings, but parts of the site will not work without them.
9. Security
We apply industry-standard safeguards: TLS for all traffic, bcrypt password hashing, SHA-256 API key hashing, session-fixation protection, CSRF tokens, rate limiting, and least-privilege access controls. To report a security concern, email [email protected].
10. Children
LottoBot is intended only for users 18 and older. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will remove it immediately.
11. Changes to This Policy
We may update this policy as the service evolves. Material changes will be announced on the site or by email. The "Last updated" date at the top of this page reflects the latest revision.
12. Contact
Questions about this Privacy Policy? Email [email protected] or use our contact page.