Privacy Policy

Who we are

LO (“Lowest. Unique. Wins.”) is run by LO Africa, Ethiopia, which decides how your personal data is used (the data controller). This policy covers the LO app for Android and iOS, the website at loafrica.net and the LO Telegram bot and Mini App. Questions or requests: [email protected].

What we collect

• Your phone number, to sign you in with a one-time code sent by SMS, WhatsApp or Telegram (your choice; numbers outside Ethiopia use WhatsApp or Telegram).
• Your full name and date of birth, given once when you sign up: LO is for people aged 18 and over, and a prize is handed only to the person who won it.
• Your bids and receipts: which prize, the number you bid, when, and the receipt that proves it was counted.
• Payments, only if you take part in a paid competition on the website or in Telegram (the LO app takes no payments): amount, provider (Chapa or telebirr), reference and status. Your card, bank or wallet details are entered on the provider's own page and never reach LO.
• If you win: the result of our identity check (the type of document and where its copy is filed, never the ID number or image), the delivery address in Ethiopia you give us, and the signature and handover photo of whoever receives the prize. We publish your name, city and a photo on the Winners tab only if you agree in writing, and you can withdraw that agreement.
• Your device and settings: a push notification token and your app language (only if you allow notifications), a label for each signed-in device, and whether you chose a break from bidding.
• Telegram: if you link Telegram, your Telegram user id.
• Security records: IP address and request details, used to stop abuse (for example too many sign-in attempts) and kept in our logs for a limited time.

We do not use advertising trackers, we do not sell your data, and the app does not read your contacts, photos or location.

Why we use it

• To run competitions: take bids, publish results anyone can verify, and hand prizes to winners (our agreement with you).
• To meet the law: age checks, financial records, and answering lawful requests from authorities (legal obligation).
• To keep LO fair and safe: prevent fraud, multiple accounts and abuse (our legitimate interest).
• To send you notices about prizes you bid on, such as “closing soon” and results (your consent, which you can turn off in your phone's settings).
• To respect a break you chose: while it lasts we refuse your bids on every channel.

Who we share it with

Only with the services that run LO for us, each for its own part of the work:

• Amazon Web Services (hosting and encryption keys; servers in the United States).
• Cloudflare (network protection and delivery of the website and API).
• SMS Ethiopia (sending SMS sign-in codes).
• Meta (WhatsApp) and Telegram (sending sign-in codes, only when you choose them): they receive your phone number and the code.
• Chapa and telebirr (taking payments).
• Google Firebase Cloud Messaging (delivering push notifications).
• Telegram (the LO bot and Mini App, if you use them).

Sponsors of a prize only ever see totals, never who took part. We disclose data to authorities only when the law requires it.

How we protect it

Your name, date of birth and phone number are encrypted with a key that belongs to your record alone, and that key is itself protected by a key held in a hardware-backed key service. We look up your phone number only through a keyed fingerprint, so it is never stored readable. Delivery addresses are encrypted the same way. All traffic uses HTTPS. Sign-in sessions are stored only as fingerprints and expire on their own (30 days on the web; in the app, 90 days after you last used it), and you can end them on every device from your account. Staff access is limited by role, protected by passkeys, and recorded.

How long we keep it

• Your identity, address and devices: until you delete your account.
• Sign-in codes and ended sessions: deleted 30 days after they expire.
• Server logs with IP addresses: 14 days.
• Bids, receipts, payments and the audit trail: kept as long as financial and regulatory rules require, because published results depend on them. After you delete your account they no longer say who you are.
• Complaints, disputes and holds: kept while open, however long that takes. While one is open your account can't be deleted, so the record a decision needs survives.

Deleting your account

To delete your account, write to [email protected] and tell us the phone number on it. Details of what is erased and what is kept are on the account deletion page.

Your rights

You can ask to see the personal data we hold about you, correct it, delete it, object to a use of it, or withdraw a consent you gave, under Ethiopia's personal data protection law and any other law that applies to you. Write to [email protected]; we answer within 30 days. If you are not satisfied, you may complain to the data protection authority in Ethiopia.

Children

LO is only for people aged 18 and over. We do not knowingly collect data from anyone younger; if we learn we have, we delete the account.

Changes

If we change how we use your data, we update this page and its date, and tell you in the app before the change applies.