Lobby Privacy Notice

Effective Date: 18 September 2026 Last Updated: 18 September 2026

This notice covers DiscoverWorthy Lobby, our mobile app for business owners and their staff. It sits alongside our Privacy Policy and adds to it — everything in that policy still applies. Where this notice is more specific about the app, this notice governs.

It exists because a phone is different from the rest of the platform. The app's whole job is to reach you when you are not at a desk, which means it holds a way to ring your handset, and it shows you what a member of the public has written to your business. Both deserve saying plainly rather than folding into a general policy.

1. Who is responsible for what

For your own account information — your email address, which businesses you belong to, your notification preferences — we are the data controller.

For your visitors' information — what somebody typed into your website's lobby, the name and number they gave — you are the controller and we are your processor. We hold it because you asked us to, and we act on your instructions. We do not use your visitors' details for DiscoverWorthy's own purposes, and we never use them to contact anybody on our own behalf.

2. What the app stores about your device

To ring your phone we keep one record per handset, per business, per person:

• a notification token issued by Google (and, on iPhone, Apple) — this is what identifies the handset to the notification service, and nothing else;
• the make and model of the device and the app version, so we can tell one of your phones from another and support you;
• your quiet hours and time zone, so routine alerts can wait until morning;
• when the app last checked in.

There is a separate record for each business you belong to, because what is worth interrupting you about is decided per business.

Signing out revokes that record, and we stop sending to that handset.

3. What a notification actually contains

Notifications about a waiting visitor deliberately carry no customer words. The alert says that somebody is waiting and nothing more. What they wrote is fetched separately, over an authenticated connection, when you open the app.

This is a deliberate choice rather than a limitation. A notification travels through Google's delivery service and can sit on a lock screen in a public place. Keeping the customer's words out of it means nothing a member of the public writes to your business passes through a third party on the way to your phone, or is readable over your shoulder.

4. Who else is involved

• Google (Firebase Cloud Messaging) delivers notifications to Android handsets. It receives the notification token and the alert itself — which, as above, contains no customer information.
• Apple (Apple Push Notification service) will do the same for iPhones when the iOS app is released.

Both act as delivery processors. Neither receives your customer records.

5. What is NOT on your phone

Conversations, customer records and business data are not stored on the handset. The app holds your sign-in and your preferences, and fetches everything else when you open it. Losing the phone does not hand somebody an offline copy of your customer list.

Your sign-in is held in the device's hardware-backed keystore.

6. Trying the app without an account

The app has a demo you can use without signing in. It runs entirely on the handset: it holds no account credential at all, which is what prevents it reaching our servers. Nothing you do in the demo is sent anywhere, and the business it shows you is fictional.

7. Permissions the app asks for

• Notifications — so it can ring. Decline it and the app still works; you check the list yourself instead.
• The Call, Text and Email buttons hand a number or address you already hold to your phone's own dialer or mail app. The app never reads your contacts.

The app does not request location.

8. Your rights, and how to reach us

Your rights, how long we keep information, where it is stored, and how to make a request are all as set out in the Privacy Policy. Questions specifically about the app can go to support@discoverworthy.com.