Lulo Ventures, Inc. (“Lulo”, “we”, “us”, or “our”) helps individuals and their families access and use eligible benefits under the Special Supplemental Nutrition Program for Women, Infants, and Children (or “WIC”). This Privacy Policy describes the privacy practices of Lulo and how we handle personal information that we collect through our website located at www.hellolulo.com (the “Site”), through our mobile and web applications, and through any other applications, websites or services that we own or control and that link to this Privacy Policy (collectively, the “Service”). 

Personal Information We Collect

Information you provide to us:

• Contact and account information, such as your email address or zipcode when you sign up to become a Lulo member, and your phone number if you reach out with questions. 

• Account Data, for any WIC Connect or EBT processor accounts that you chose to log into via Lulo including your account username and password and the type(s) of government-administered benefits that you receive. We use this information to facilitate logging into your WIC Connect or EBT processor accounts account, and for account security purposes.

• Transaction and benefit information of items purchased using WIC benefits, such as transaction date, items and quantities purchased, name and location of stores where such items were purchased and start and end date of eligible WIC benefits. 

• Communications that we exchange with you, including when you respond to surveys or contact us with questions, feedback or otherwise correspond with us.

• Marketing information, such as your preferences for receiving communications, and details about how you engage with our communications.

• Credentials to access accounts associated with your WIC benefits, including username, password, security questions and answers.

• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information we obtain from third parties: When you grant us access to your account with a third-party service, such as an EBT processor,  we may collect or receive personal information such as first and last name, email address, phone number, account credentials including username, password, security question and answer, transaction and benefit information, as permitted by your account settings on the third-party service. The information we receive from your third-party account depends on the settings, permissions and privacy policy controlled by that third-party service. You should always check the privacy settings and notices in the relevant third-party services to understand what data may be disclosed to us or shared with us.

Automatic data collection. We and our service providers may automatically log and combine information about you, your computer or mobile device, and your interaction over time with the Service, online resources, and our communications, such as:

• Device data such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings and general location information such as city, state, or geographic area.

• Online activity data such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times, duration of access, and whether you have opened or otherwise engage with our communications.

• Location information. If you have enabled location services on your device, we may collect location information to provide the Service. You may opt out of location tracking as described in the “Privacy Choices” section below.

We use the following tools for automatic data collection:

• Cookies, which are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, and helping us understand user activity and patterns.

• Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.

• SDKs, which are blocks of code provided by our partners that may be installed in our mobile applications. SDKs help us understand how you interact with the Mobile App and collect certain information about the device and network you use to access the Mobile App.

• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

Our Use of Tracking and Analytics Technologies

We may also collect analytics data, or use third-party analytics tools, to help us measure traffic and usage trends for our Services over time through cookies, pixel tags, and related technologies. We use the below analytics providers, which allow us to better understand how our users interact with our Services, and allow us to better tailor our content to you. We do not control the privacy practices of these third parties and cannot be held responsible for them (e.g., if they fail to comply with opt-out requests).

Google Analytics. Google Analytics uses cookies to collect information about how users interact with some of our Services. This information is generally transferred to and stored on a Google server in the USA. For more information on how Google Analytics collects and processes data, please visit https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage.

Amplitude. We also use Amplitude, a tool which provides product analytics for our web application. Amplitude helps us understand how you use our web application so we can improve the experience. Additional information about the manner in which Amplitude processes data is available at: https://amplitude.com/privacy.

How We Use Personal Information

We use personal information for the following purposes or as otherwise described at the time of collection:

Provide our Service. We use personal information to operate, maintain, and provide you with our Service, including matching your WIC benefits to products you are eligible for. 

Communicate with you about our Service. We use personal information to respond to your requests, provide user support, communicate with you about our Service, including by sending announcements, surveys, reminders, updates, security alerts, and support and administrative messages.

Improve, monitor, personalize, and protect our Service. We use your personal information to improve and keep our Service safe for our users, which includes: 

• Understanding your needs and interests, and personalizing your experience with the Service and our communications.

• Improving and adding features to our Service.

• Troubleshooting, testing and research, and keeping the Service secure.

For marketing and advertising. We and our advertising partners may collect and use your personal information for marketing and advertising purposes, including:

• Email. We may from time-to-time send you direct marketing emails, including, but not limited to, notifying you of special promotions, offers and events via email. You may opt out of our marketing emails as described in the “Opt-out of marketing communications” section below. 

• Interest-based advertising. We may engage our advertising partners, including third party advertising companies and social media companies, to display ads around the web. These companies may use cookies and similar technologies to collect information about your interaction over time across our Service, our communications, and other online services, and use that information to serve online ads that they think will interest you. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. You can learn more about your choices for limiting interest-based advertising in the “Third-party opt-out” section below.

Research and development. We may use personal information for research and development purposes, including to analyze trends, usage, activities and statistics, and to improve the Service and our business. As part of these activities, we may create or use aggregated, de-identified or other anonymized data from personal information we collect. 

Compliance and protection. We may use personal information to comply with legal obligations, and to defend us against legal claims or disputes, including to:

• Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims).

• Audit our internal processes for compliance with legal and contractual requirements and internal policies.

• Enforce the terms and conditions that govern the Service.

• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

• Comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

How We Disclose Personal Information

We may disclose your personal information to third parties as described below:

• Service providers. We may rely on third-party service providers in furtherance of the purposes described above. In these cases, personal information may be accessed by these third parties and processed or stored on our behalf. These service providers can include hosting services, cloud computing and storage services, maintenance services, security services, and user support services. 

• Professional advisors. We may disclose personal information to professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

• Authorities and others. Law enforcement, government authorities and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

• Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Lulo (including, in connection with a bankruptcy or similar proceedings).

We additionally may share your IP address with our partner organizations, and may also share data that we collect from or about you on an aggregate or anonymous basis (such that it does not identify you). This may occur, for example, if you click on an advertisement that links to a third-party partner’s platform while using our services. Lulo does not sell your personal information to any third party, but we may provide certain of your personal information to third parties to facilitate account creation, identity and benefits verification, or similar purposes.

Your WIC Connect or EBT processor account credentials will never be shared with anyone by us or our service providers except as necessary to enable you to see your WIC food package balance, transactions, or appointments.

Privacy Choices

Delete your account. You may request that we delete your account by contacting us as provided in the “How to Contact Us” section below.

Opt out of marketing communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions in the emails you receive from us. You may also opt out of receiving marketing communications from us by contacting us as provided in the “How to Contact Us” section below. To stop receiving SMS messages from us, please reply “STOP” to the last message you received. You can manage push notifications preferences or deactivate these notifications at any time by configuring your preferences for notifications in the settings section on your device. You may continue to receive Service-related and other non-marketing communications.

Opt out of location tracking. You can control our collection of location data using your mobile device’s settings. Please note, however, that if you opt out of Lulo’s collection of location information, you may no longer be able to use some features of the Service.

Third-party opt-out. There are a number of ways to limit online tracking, which we have summarized below. Please note that these opt-out tools are not associated with Lulo and we cannot guarantee that these tools work as their providers advertise them:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit https://www.allaboutcookies.org/. 

• Using privacy plug-ins or browsers. You can block our websites from setting cookies by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers. Where Google Analytics is used, you can also opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.  You can learn more about Google Analytics’ practices at https://policies.google.com/technologies/partner-sites.

• Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.

• Platform opt-outs. The following advertising partners offer opt-out features that let you opt out of use of your information for interest-based advertising:

• Google

• Facebook

• LinkedIn

• Microsoft

• Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:

• Digital Advertising Alliance

• Network Advertising Initiative

Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use to access or interact with our Service.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Security

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information. 

Data Storage

We may store the last 4 digits of your EBT card number, and a hash of the full card number, on our servers. We may also store your EBT processor account credentials on our servers. Your EBT processor account credentials may include a username, password (stored in an encrypted format), security question,  and security question answer (stored in an encrypted format), and any other information needed to access your EBT processor account.

Other Sites and Services

Our Service may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. This Privacy Policy does not apply to such third-party sites or services. 

Use of the Service by Minors

Our Service is not directed to children, and we do not knowingly collect personal information from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us as set out in the “How to Contact Us” section below.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time and from time to time without prior notice. We encourage you to periodically review this page for the latest information on our privacy practices. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service, or as otherwise required by law. 

How to Contact Us

If you have any questions about this Policy or our privacy practices, or to submit a personal information request, please contact us by email at contact@hellolulo.com.