Privacy Policy

For merchant data — your account, your business, your billing, your use of the dashboard — we are the controller. We decide why and how it is processed, and this policy applies directly.

For the data of the customers who play a wheel, the merchant running that wheel is the controller and we act as its processor. We process that data on the merchant's instructions, only to run the Service. If you played a wheel and want to exercise your rights, contact the business whose QR code you scanned first; we will help it respond, and you can also write to us at hello@getseeu.com.

From merchants:

• Account: first name, last name, email address, password (stored hashed by our authentication provider), and the Google account identifier if you sign in with Google.
• Business: business name, address, country, phone number, logo and the details shown on your wheel and QR kit.
• Wheel content: prizes, odds, colours, texts and the link to your Google Business Profile.
• Billing: plan, currency, subscription and payment status, invoices, and the customer identifier held by our payment provider. Full card numbers are handled by Stripe and never reach our servers.
• Usage and technical: pages viewed, actions taken in the dashboard, IP address, browser and device type, approximate location derived from the IP address, timestamps, and error logs.
• Support: the content of the messages you send us.

From the customers who play a wheel:

• The details they enter on the wheel page, typically first name and email address, and phone number where the merchant asks for it.
• Play data: the scan, the spin, the prize won, whether it was claimed and when.
• Technical data needed to serve the page and prevent abuse, including IP address, browser type and timestamps.

We do not knowingly collect special-category data, and the Service must not be used to collect it. We do not knowingly collect data from children: accounts are for adults acting for a business, and wheels must not be aimed at children.

• To provide the Service — create your account, run your wheel, serve the public page, generate the QR kit, record spins and prizes, show your dashboard. Basis: performance of our contract with you.
• To take payment, prevent chargebacks and issue invoices. Basis: performance of our contract and our legal obligations.
• To provide support and communicate about the Service, including security and billing notices. Basis: performance of our contract and our legitimate interest in running it properly.
• To secure the Service — detect fraud, abuse, fake scans and attacks, apply rate limits, keep logs. Basis: our legitimate interest in protecting the Service and its users.
• To measure and improve the Service, in aggregate wherever possible. Basis: our legitimate interest in improving what we offer.
• To market Lucky Wheel to businesses and measure our advertising. Basis: our legitimate interest, or your consent where the law requires it. You can opt out of marketing emails at any time using the unsubscribe link.
• To comply with the law and to establish, exercise or defend legal claims. Basis: our legal obligations and our legitimate interest.

Where our basis is legitimate interest, we have weighed it against your rights and freedoms, and you may object at any time (see article 9).

We use cookies and similar technologies that are strictly necessary to run the Service — keeping you signed in, securing forms, remembering your language and your cookie choice. These cannot be switched off.

We also use the Meta pixel and the Meta Conversions API to measure the performance of our own advertising for Lucky Wheel. The pixel runs in the browser; the Conversions API sends the same events from our servers so a single conversion is not counted twice. Contact details sent through the Conversions API are hashed with SHA-256 before they leave our servers.

These measurement tools are only loaded once you have accepted them in our cookie banner. Until you do, no Meta script is loaded in your browser and no event is sent to Meta from our servers either. They are never used to profile the customers who play a merchant's wheel.

You can change your choice at any time from the “Cookie settings” link at the bottom of every page, or block cookies from your browser settings. Withdrawing your consent stops any further measurement.

We never sell personal data and we do not share it for cross-context behavioural advertising. We share it only with providers who process it on our behalf, under contract and on our instructions:

• Google Cloud / Firebase — hosting, database, authentication and file storage.
• Stripe — payment processing, subscription management and invoicing.
• Meta Platforms — advertising measurement for our own marketing, as described in article 4.
• Mailjet — transactional and support email, sent from servers located in the European Union.

For the customers who play a wheel, we also make their data available to the merchant whose wheel they played. That merchant is the controller of it and is responsible for what it does with it.

We may disclose data where the law requires it, to respond to a valid request from a public authority, to enforce our Terms, or to protect the rights and safety of SeeU, our users or the public.

If SeeU is involved in a merger, acquisition or sale of assets, data may be transferred as part of it. We will tell you before it becomes subject to a different privacy policy.

We operate from the United States and our providers operate globally, so personal data may be processed in countries other than yours, including the United States.

Where data is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate safeguard — normally the European Commission's Standard Contractual Clauses with the UK Addendum where relevant — together with additional technical and organisational measures. You can ask us for details at hello@getseeu.com.

• Account and business data: for as long as your account is open, then up to 12 months after closure, so the account can be restored and disputes handled.
• Wheel content: for as long as your account is open, then deleted with it.
• Data of customers who played your wheel: for as long as your account is open, unless you delete it sooner from your dashboard, then deleted within 90 days of closure. Export what you need before you close your account.
• Billing records and invoices: up to 10 years, to meet accounting and tax obligations.
• Security and technical logs: up to 12 months.
• Support messages: up to 3 years after the last exchange.

We may keep data longer where the law requires it, or while it is needed to establish, exercise or defend a legal claim.

We use technical and organisational measures appropriate to the risk: encryption in transit, encryption at rest with our hosting provider, hashed passwords, database access rules that keep each merchant's data separate, least-privilege access for our team, and logging of administrative actions.

No system is perfectly secure. If a breach is likely to affect your rights, we will notify you and the competent authority within the time limits the law sets.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and obtain a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data, where no legal obligation requires us to keep it.
• Restrict or object to a processing based on our legitimate interest, including direct marketing, which you can always refuse.
• Receive your data in a portable, machine-readable format, and have it transmitted to another provider.
• Withdraw a consent you gave, without affecting what was done before you withdrew it.
• Not be subject to a decision based solely on automated processing with a legal or similarly significant effect. We do not take such decisions.

Much of this is immediate from your dashboard: edit your details, delete leads, export your data or close your account. For anything else, write to hello@getseeu.com. We reply within 30 days and may ask you to confirm your identity before we act.

If you are in the EEA, the UK or Switzerland, you may also lodge a complaint with your local data protection authority. If you are in California, you may exercise the rights the CCPA/CPRA gives you, including the right to know, delete and correct, and the right to be free from discrimination for exercising them; note again that we do not sell or share personal data as those terms are defined there.

When you collect your customers' details through a wheel, you are the controller of that data. You must have a valid legal basis, tell your customers who you are and what you will do with their details, publish your own privacy notice, honour their rights, and get the consent that applies where you operate before sending them marketing.

We process that data only on your instructions, to run the Service, and we help you meet these obligations — export, deletion, and the security measures set out above.

Where the GDPR applies to your processing, this article together with the Terms of Service forms our data processing agreement. Ask us at hello@getseeu.com if you need a separate signed one.

We may update this policy. Only the latest version published on the Service applies.

For a significant change we will tell you by email or in the dashboard at least 30 days before it takes effect.

For any question or request about this policy, or to exercise your rights, write to hello@getseeu.com.

SeeU LLC — 8 The Green, Suite A, Dover, DE 19901, United States — registered in Delaware, United States, EIN 98-1833102.