Start free
Legal

Privacy Policy

Last updated: August 30, 2026 (supersedes the version of 4 May 2023)

Controller: Lutendotech OÜ, registration number 16734112, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia — [email protected]

Scope: https://lutendo.com, https://lutendo.app, and the services provided through them (the "Services"). This policy explains what personal data we process, why, on which legal basis, how long we keep it, who receives it, and your rights. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

1. What we process, why, and on which legal basis

a) Account data (Sellers & Testers) — name, email address, phone number, address, company details (Sellers), login and security data. Purpose: providing the Services, account security, communication. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); security also legitimate interest (Art. 6(1)(f)).

b) Campaign & participation data — campaigns created, applications, statuses, deadlines, order IDs of campaign purchases, submitted proof (for example screenshots or review URLs), and messages within the platform's structured flows. Purpose: operating a campaign process both sides can rely on. Basis: contract.

c) Review verification data — the public review URL, its public content and author handle, and our crawler's confirmation records matching the review to the participating Tester. Purpose: verifying that reviews are genuine — the core of the Services — and preventing fraud. Basis: contract; fraud prevention as legitimate interest. Review content is public data on the external platform; we process it to verify existence and authorship, not to influence it.

d) Payout & financial data (Testers) — your payout identity and the transactions attached to it: bank details (IBAN) for Guaranteed Payouts and withdrawals; for Seller-Processed Reimbursements, the payout method you designate, which may be PayPal, bank transfer, or a cryptocurrency wallet address; your Wallet ledger, reimbursements, withdrawals, and holds. Purpose: executing guaranteed payouts, documenting seller-processed reimbursements, withdrawal processing, dispute resolution. Basis: contract; retention of transaction records also legal obligation (accounting law). We never ask you to share payout details in free-text messages.

e) Seller billing data — credit and plan purchases, fees, deposits for reimbursement pools, invoices, outstanding bills. Basis: contract; legal obligation (accounting and tax law).

f) Fraud-prevention & integrity data — signals such as return flags, verification anomalies, account restriction states, IP addresses, and device identifiers. Purpose: preventing reimbursement abuse, fake reviews, and multi-accounting; protecting the platform, Sellers, Testers, and review readers. Basis: legitimate interest; where applicable, legal obligation. Fraud signals are reviewed by humans before any account-level consequences are applied; we do not make decisions producing legal or similarly significant effects by solely automated means.

g) Points & program data (Testers) — points, multipliers, team membership, leaderboard entries (displayed pseudonymously), and prize eligibility. Basis: contract (the program's terms).

h) Technical data — IP address, browser and operating system, timestamps, referrer, log files, and session data. Purpose: operating and securing the websites. Basis: legitimate interest.

i) Cookies & similar technologies — strictly necessary cookies run without consent. Analytics and marketing cookies, and third-party embeds (see §3), are set only with your consent, which we collect and manage through the CookieYes consent management tool (Art. 6(1)(a) GDPR and applicable e-privacy rules). You can change or withdraw your consent at any time in the cookie settings.

j) Support & communication — your contact details and the content of your messages; logs of support interactions. Basis: contract and legitimate interest (service quality).

k) Marketing & lead forms — newsletter subscriptions and the request forms on our websites (for example platform-availability and free-review requests, which store your platform choice, the URL you provide, your email address, and your consent flag). Purpose: responding to your request and, only with your consent, contacting you about relevant offers. Basis: consent; you can unsubscribe at any time via the link in every email. Existing-customer email communication where permitted by law, with opt-out.

We do not process special categories of personal data (Art. 9 GDPR) and we do not sell personal data.

2. Where data comes from

From you; generated by your use of the platform; from the external review platform (public review data, for verification); from payment providers (payment status — never full card numbers); and from your Seller/Tester counterpart within the campaign process (for example an order ID or submitted proof).

3. Recipients & processors

Personal data is shared only as needed to provide the Services:

  • Hosting: Hetzner Online GmbH, Germany (data center FSN1)
  • Payments & payouts: Stripe (seller card payments and supported wallets); banks for SEPA transfers; ConnectPay (payout processing)
  • Consent management: CookieYes
  • Analytics (consent-based): Google Analytics; PostHog
  • Email & communications: Resend; Amazon Web Services (email infrastructure)
  • Scheduling: Calendly (embedded booking — loads only after consent)
  • Public authorities where legally required; professional advisors under confidentiality; and, in the event of a merger, acquisition, financing, or transfer of business assets, the parties involved (with notice to you).

All processors are bound by data-processing agreements under Art. 28 GDPR. Where data is transferred outside the EEA (for example to providers in the United States), we rely on adequacy decisions or the EU Standard Contractual Clauses together with supplementary measures, per vendor.

4. Retention

  • Account data: for the duration of your account; deleted or anonymized within 1 month of account closure, unless longer retention is legally required.
  • Transaction, invoice and Wallet records: retained for the statutory accounting period — 7 years under Estonian law, and up to 10 years where German accounting or tax law applies to the record.
  • Verification and fraud-prevention records: 2 years after the related participation ends, for the establishment, exercise, or defense of legal claims.
  • Support logs: 6 months.
  • Consent records: for as long as needed to demonstrate consent was given.

5. Your rights

You have the right to access, rectify, and erase your personal data; to restrict processing; to data portability; to object to processing based on legitimate interest (including to direct marketing at any time); and to withdraw consent at any time with effect for the future. Contact [email protected] — exercising your rights is free of charge. You also have the right to lodge a complaint with a supervisory authority: the Estonian Data Protection Inspectorate (https://www.aki.ee/en) or the authority of your place of residence — in Germany, the competent state data protection authority (Landesdatenschutzbehörde).

6. Security

We use encryption in transit, access controls, least-privilege access, logging, and contractual safeguards with our processors. No method of transmission or storage is 100% secure; where required by Art. 33/34 GDPR, we notify the supervisory authority and affected users of personal data breaches.

7. Third-party platforms

Reviews are published on external platforms (marketplaces, Google, Trustpilot, TripAdvisor) under their own terms and privacy policies; we are not responsible for their processing. Our websites may contain links to third-party sites governed by those sites' policies.

8. Minors

The Services are not directed at persons under 18. We do not knowingly process their data and will delete such accounts upon discovery.

9. Changes to this policy

We will post updates on this page and flag material changes prominently on the website or by email. Please check back regularly.

Contact: Lutendotech OÜ · Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia · [email protected]