Privacy policy

Last updated: 2 May 2022

Welcome to Lily, a customer loyalty platform (the “App”) for merchants (the “Merchants”). The App is owned and operated by Lily LLC (“we”, “us”, “our”).

Your privacy is important to us. This Privacy Policy describes how we collect, use, disclose, and otherwise process Personal Information in connection with the App.

The Information the Website Collects

We may collect the following Personal Information from our Site visitors on our website (getlily.io):

Inquiry Information;
Analytics Data, collected via cookies associated with Google Analytics, and Mixpanel, if you give us your consent.

The Information the App Collects

After you install the App and give permission, we will collect the following information from your Store:

Your and your store information

When you install the App on your online store, we obtain your name, email address, phone number, country, city, and ZIP code. We also obtain your store information: domain, plan.

Your customer information

While you use the App, we collect information on your store customers: name, email address, address, and order history (date, amounts, items).

User-generated content

While you use the App, we collect any information your customer chooses to provide through the App: reward points, VIP tiers, referrals, and customer reviews. We also collect your customers' metadata related to their usage of the App.

Analytical information

When you use the App, we collect information about your use of the App. For example, we may record the frequency and scope of your use, action taken while using the App, and the interactions you make with the App.
We also collect Analytic information about your customers’ use of the App and your store.

Legitimate Reasons for Processing Your Personal Information

We only collect and use your personal information when we have a legitimate reason for doing so. In which instance, we only collect personal information that is reasonably necessary to provide our services to you.

Children’s Privacy

We do not aim any of our products or services directly at children under the age of 13, and we do not knowingly collect personal information about children under 13.

How We Process and Use Personal Data

To operate the App and provide its functionality

We process the Information we collect about you, your store, and customers to identify you and operate the App, and provide you with its features and functionality.
‍Legal basis: Legitimate interests, contract

To improve the App

We process your Analytics information to understand how users interact with the App so that we can personalize, develop and improve it.
‍Legal basis: Legitimate interests, contract

Support

Resolving issues via live chat, phone or email support, letting you know about changes to our service and how the App is doing.
‍Legal basis: Contract

Marketing

Sending emails and messages to you about updates to your usage of the App, changes to the service, and marketing communications about new features, products, services, and content.You may 'opt-out' of using your information for marketing communications by sending an email to: support@getlily.io, or as otherwise provided in our marketing communications. By doing so, we will only delete or stop processing the information which is required to contact you for marketing communications, while the rest of the Information which is necessary to provide you with the Service will continue to be processed and used.
‍Legal basis: Legitimate interests, contract

Security of Your Personal Information

When we collect and process personal information, and while we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use, or modification.

Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security.

Where Do We Store Your Data

Your data is stored through Amazon's databases on a secure server behind a firewall in the United States.

The countries to which we store, process, or transfer your personal information may not have the same data protection laws as the country in which you initially provided the information. If we transfer your personal information to third parties in other countries: (i) we will perform those transfers in accordance with the requirements of applicable law; and (ii) we will protect the transferred personal information in accordance with this privacy policy.

How Long We Keep Your Personal Information

We retain your personal data as long as the App is installed in your store. Thereafter, we will continue to retain your personal information as necessary to comply with our legal obligations, resolve disputes, establish and defend legal claims.

When Is Your Personal Data Shared With Others

We do not sell your personal information to third parties.
We may disclose personal information to

a parent, subsidiary, or affiliate of our company
third-party service providers for the purpose of enabling them to provide their services, including (without limitation) IT service providers, data storage, hosting and server providers, analytics, error loggers, maintenance or problem-solving providers, marketing providers, professional advisors, and payment systems operators
our employees, contractors, and/or related entities
our existing or potential agents or business partners
courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights
third parties, including agents or sub-contractors, who assist us in providing information, products, services, or direct marketing to you
third parties to collect and process data
an entity that buys, or to which we transfer all or substantially all of our assets and business

Third parties we currently use include:

Google Analytics, Mixpanel, Facebook, Microsoft, Reddit, Twitter, LinkedIn, Quora;
MailChimp, Intercom, Helpcrunch, Google Workspace, Survicate;
Amazon, Partnermetrics, Sentry, HilbertTeam;

Your Rights and Controlling Your Personal Information

Your choice: By providing personal information to us, you understand we will collect, hold, use, and disclose your personal information in accordance with this privacy policy. You do not have to provide personal information to us, however, if you do not, it may affect your use of our website or the products and/or services offered on or through it.

Information from third parties: If we receive personal information about you from a third party, we will protect it as set out in this privacy policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person’s consent to provide the personal information to us.

Marketing permission: If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by contacting us using the details below.

Access: You may request details of the personal information that we hold about you.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact us using the details provided in this privacy policy. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading, or out of date.

Non-discrimination: We will not discriminate against you for exercising any of your rights over your personal information. Unless your personal information is required to provide you with a particular service or offer (for example processing transaction data), we will not deny you goods or services and/or charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties, or provide you with a different level or quality of goods or services.

Downloading of Personal Information: We provide a means for you to download the personal information you have shared through our site. Please contact us for more information.

Notification of data breaches: We will comply with laws applicable to us in respect of any data breach.

Complaints: If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below and provide us with full details of the alleged breach. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take to deal with your complaint. You also have the right to contact a regulatory body or data protection authority in relation to your complaint.

Use of Cookies

We use “cookies” to collect information about you and your activity across our site. A cookie is a small piece of data that our website stores on your computer, and accesses each time you visit, so we can understand how you use our site. This helps us serve you content based on preferences you have specified.

Business Transfers

If we or our assets are acquired, or in the unlikely event that we go out of business or enter bankruptcy, we would include data, including your personal information, among the assets transferred to any parties who acquire us. You acknowledge that such transfers may occur and that any parties who acquire us may, to the extent permitted by applicable law, continue to use your personal information according to this policy, which they will be required to assume as it is the basis for any ownership or use rights we have over such information.

Limits of Our Policy

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to This Policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy.

If the changes are significant, or if required by applicable law, we will contact you (based on your selected preferences for communications from us) and all our registered users with the new details and links to the updated or changed policy.

If required by law, we will get your permission or give you the opportunity to opt in to or opt-out of, as applicable, any new uses of your personal information.

Additional Disclosures for Australian Privacy Act Compliance (AU)

International Transfers of Personal Information

Where the disclosure of your personal information is solely subject to Australian privacy laws, you acknowledge that some third parties may not be regulated by the Privacy Act and the Australian Privacy Principles in the Privacy Act. You acknowledge that if any such third party engages in any act or practice that contravenes the Australian Privacy Principles, it would not be accountable under the Privacy Act, and you will not be able to seek redress under the Privacy Act.

Additional Disclosures for General Data Protection Regulation (GDPR) Compliance (EU)

Data Controller / Data Processor

Lily LLC is the data controller of your personal data we collect and process through the App.

Lily LLC is the data processor of your Customers Information we collect and process through the App.

Your Rights and Controlling Your Personal Information

Restrict: You have the right to request that we restrict the processing of your personal information if (i) you are concerned about the accuracy of your personal information; (ii) you believe your personal information has been unlawfully processed; (iii) you need us to maintain the personal information solely for the purpose of a legal claim; or (iv) we are in the process of considering your objection in relation to processing on the basis of legitimate interests.

Objecting to processing: You have the right to object to processing of your personal information that is based on our legitimate interests or public interest. If this is done, we must provide compelling legitimate grounds for the processing which overrides your interests, rights, and freedoms, in order to proceed with the processing of your personal information.

Data portability: You may have the right to request a copy of the personal information we hold about you. Where possible, we will provide this information in a structured, commonly used and machine-readable format. You may also have the right to request that we transfer this personal information to a third party.

Deletion: You may have a right to request that we delete the personal information we hold about you at any time, and we will take reasonable steps to delete your personal information from our current records. If you ask us to delete your personal information, we will let you know how the deletion affects your use of our website or products and services. There may be exceptions to this right for specific legal reasons which, if applicable, we will set out for you in response to your request. If you terminate or delete your account, we will delete your personal information within 14 days of the deletion of your account. Please be aware that search engines and similar third parties may still retain copies of your personal information that has been made public at least once, like certain profile information and public comments, even after you have deleted the information from our services or deactivated your account.

Additional Disclosures for California Compliance (US)

Under California Civil Code Section 1798.83, if you live in California and your business relationship with us is mainly for personal, family, or household purposes, you may ask us about the information we release to other organizations for their marketing purposes.

To make such a request, please contact us using the details provided in this privacy policy with “Request for California privacy information” in the subject line. You may make this type of request once every calendar year. We will email you a list of categories of personal information we revealed to other organizations for their marketing purposes in the last calendar year, along with their names and addresses. Not all personal information shared in this way is covered by Section 1798.83 of the California Civil Code.

Do Not Track

Some browsers have a “Do Not Track” feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser “Do Not Track” signals.

We adhere to the standards outlined in this privacy policy, ensuring we collect and process personal information lawfully, fairly, transparently, and with legitimate, legal reasons for doing so.

Cookies and Pixels

At all times, you may decline cookies from our site if your browser permits. Most browsers allow you to activate settings on your browser to refuse the setting of all or some cookies. Accordingly, your ability to limit cookies is based only on your browser’s capabilities. Please refer to the Cookies section of this privacy policy for more information.

CCPA-permitted financial incentives

In accordance with your right to non-discrimination, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels for the goods or services we provide.

Any CCPA-permitted financial incentive we offer will reasonably relate to the value of your personal information, and we will provide written terms that describe clearly the nature of such an offer. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

California Notice of Collection

In the past 12 months, we have collected the following categories of personal information enumerated in the California Consumer Privacy Act:

Identifiers, such as name, email address, phone number account name, IP address, and an ID or number assigned to your account.
Commercial information, such as products or services history and purchases.
Internet activity, such as your interactions with our service.
Audio or visual data, such as photos or videos you share with us or post on the service.
Inferences, such as information about your interests, preferences, and favorites.

For more information on information we collect, including the sources we receive information from, review the “The Information the Website Collects” and “The Information the App Collects” sections. We collect and use these categories of personal information for the business purposes described in this Privacy Policy.

Right to Know and Delete

If you are a California resident, you have rights to delete your personal information we collected and know certain information about our data practices in the preceding 12 months. In particular, you have the right to request the following from us:

The categories of personal information we have collected about you;
The categories of sources from which the personal information was collected;
The categories of personal information about you we disclosed for a business purpose or sold;
The categories of third parties to whom the personal information was disclosed for a business purpose or sold;
The business or commercial purpose for collecting or selling the personal information; and
The specific pieces of personal information we have collected about you.

To exercise any of these rights, please contact us using the details provided in this privacy policy.

Shine the Light

If you are a California resident, in addition to the rights discussed above, you have the right to request information from us regarding the manner in which we share certain personal information as defined by California’s “Shine the Light” with third parties and affiliates for their own direct marketing purposes.

To receive this information, send us a request using the contact details provided in this privacy policy. Requests must include “California Privacy Rights Request” in the first line of the description and include your name, store domain, street address, city, state, and ZIP code.

Contact Us

For any questions or concerns regarding your privacy, you may contact us at support@getlily.io