Privacy Policy

Last updated on Oct 16, 2025

Welcome to Lilo! We are excited to have you here, and we hope that you are equally as excited to learn about how we protect personal information shared with us from our business partners. Just like hotel guests trust their preferred hotels to keep them comfortable and well rested, we want you to trust us with any personal information or business information you may supply to us. We are committed to being transparent about our privacy practices and to giving you control over how your information is collected, used, and shared.

This Privacy Policy and Notice ("Privacy Policy") covers all uses of our business-to-business procurement website and mobile application (collectively, the “Platform”) and more specifically:

Businesses such as hotels, resorts, gyms and warehouses ("Customers") who use our Platform and related services; and
Product manufacturers, distributors, or other vendors and suppliers ("Vendors") who use our Platform and related services.

As used in this Privacy Policy, "Platform" refers to the Platform and "Services" refers to the aforementioned services related to the Platform.

Please read this Privacy Policy carefully to understand the personal information we collect, how we use it, and the choices available to you. If you do not agree to this Privacy Policy, please do not use the Platform or Services.

1. Scope

1.1. Jurisdiction and Applicable Laws

Our Platform is primarily intended for U.S.-based businesses and residents. We do not offer purchases of products through the Platform outside of the United States ("U.S."). However, please note that we have a subsidiary entity located in Chile which supports certain administrative and operational functions, including limited data processing activities. These operations are conducted in accordance with applicable U.S. privacy laws and under strict data protection and confidentiality protocols.

"Privacy Laws" as used in this Privacy Policy refers to U.S. federal and state privacy laws currently in force and binding upon us and applicable to you, which may include, for example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CPRA/CCPA"), and similar laws in Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Delaware, Montana, New Jersey, and Tennessee (collectively, "State Privacy Laws"). We comply with applicable requirements, including those regarding privacy rights and opt-out controls described in Section 6 (Your Rights and Choices).

“Personal Information” as used in this Privacy Policy means information which identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under the Privacy Laws as ‘personal information,’ ‘personal data,’ ‘personally identifiable information,’ or the like; however, it does not apply to: (a) publicly available information from government records; and (b) de-identified and aggregated information maintained in accordance with Section 9.

As used herein, the term “End Users” refers to those employees, agents, contractors, or other authorized users of a Customer or Vendor who use the Platform or Services and who have an established business relationship with us. The term “Consumer” as used in this Privacy Policy means a natural person, and includes End Users.

Sensitive Personal Information ("SPI"). Where required by law, we treat certain data as SPI (for example, account log‑in credentials in combination with a password or PIN, precise geolocation, or contents of communications where we are not the intended recipient). We use SPI only for necessary purposes (e.g., authentication, security), do not use it to infer characteristics, and provide limiting mechanisms where required (see Section 6.4).

1.2. Out‑of‑Scope

This Privacy Policy applies only to the collection, use, and sharing of Personal Information by Lilo in connection with your use of the Platform and related Services. The following types of information are considered outside the scope of this policy:

Information collected by third parties: This includes any data collected directly by Vendors or other third parties through their own websites, platforms, or services—even if you access those services via the Platform. The applicable third party’s privacy policy governs that data.
Certain business information that cannot reasonably be linked to a person: For instance, de‑identified procurement strategies, operational procedures, or product pricing data that cannot reasonably be associated with an individual. Note: If business or payment information (e.g., a corporate card number or order history) can reasonably be linked to a natural person, we treat it as Personal Information under this Policy.
Employment‑related data collected outside the Platform: Such as employee performance evaluations, HR records, or hiring information collected through external channels, even if those employees later interact with the Platform.
Aggregate, de‑identified analytics: Insights or reporting generated from anonymized business trends across hotel chains, geographic zones, or product categories, which cannot reasonably be used to identify individual users, as further described in Section 9.

Handling of the above data types may be governed by separate contracts or service agreements, such as vendor contracts, customer service terms, or corporate NDAs.

1.3. Minors

The Platform and Services are not intended for children under eighteen (18) years of age. No one under the age of 18 may provide any information to, on, or through the Platform or Services. We do not knowingly collect Personal Information from children under 18. If we learn we have collected or received Personal Information from a child under 18, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us using any of the contact methods in the Contact Us section.

2. Information We Collect

The information we collect about you depends on the Platform and Services you use, how you use them, and the information you provide to us. Depending on which Platform and Services you use, we collect different types of information about your business, company, hotel, group, or other entity you represent, as well as information about you, our End User.

We collect information in three main ways: (1) information you provide directly to us; (2) information we collect automatically through technology when you use the Platform and Services; and (3) information we collect from other sources.

2.1. Information You Provide Directly to Us

When you use our Services, you may provide certain information to us. For example, we collect information directly from you when you create or use a Lilo account, participate in Lilo surveys or research, purchase products and interact with the Services, engage with us through our sales and marketing efforts, or communicate and interact with us.

Some of the most common categories of Personal Information we collect directly from End Users include:

Contact and account information, such as your name, email address, login credentials, and your business contact information and title/role. For business staff submitting orders via the platform, we may also collect certain identifying information, including, for example, your employee ID, your signature, and/or a unique PIN number.
Customer service interaction information, such as messages submitted to us through online forms or email, and summaries, transcriptions, or voice recordings of interactions with our customer service personnel. For End Users associated with Customers that use the platform, we may also collect communications and conversations with clients to or through the platform and related Services. For End Users associated with Customers on our Platform, we may also collect information from you when you submit forms, provide information or responses in discussion forums, or otherwise communicate or interact with us.
Information related to loyalty programs, redemption campaigns, sweepstakes, including information needed for you to participate in, and for us to fulfill, your prize or participation incentives (if any) (see Section 10).

2.2. Information Collected Automatically

The information we automatically collect when you use the Platform and Services includes information about your access to and use of the websites and emails, such as your IP address, browser language, the state from which you accessed the Platform or Services based on the location of your device, software and hardware attributes (including device IDs, operating system, and browser type), referring and exit URLs, the links you click and the files you download, pages viewed and the order of those pages, the amount of time spent on particular pages, the terms you use in searches on our website, the date and time you accessed our websites or opened our emails, and other similar information.

To collect this information, we and our service providers use technologies, including cookies, web beacons, pixels, and similar tracking technologies, to automatically collect certain types of usage and device information when you use the Platform or Services. These cookies may be categorized as:

Essential cookies: Required for core functionalities like security and order processing.
Performance cookies: Used to understand how users interact with the Platform, including pages visited and error messages received.
Functionality cookies: Enable enhanced features such as remembering user preferences or account history.
Advertising/targeting cookies: May be used by us or third parties to build a profile of your interests and show you relevant ads.

The Platform uses these technologies to enhance the user experience by retaining information about which items have been added to carts, monitoring general traffic trends, and analyzing behavior on the Platform. This data helps us ensure the Platform is operating efficiently and that we are offering useful tools and content to our End Users (including you). You can manage cookies in your browser settings. To request an advertising opt‑out (sale/share/targeted advertising), email support@lilohq.com with the subject line “Privacy Opt‑Out.”

Do Not Track / Global Privacy Control. At this time, we do not respond to browser "Do Not Track" (DNT) signals. We do recognize and honor the Global Privacy Control (GPC) signal as a valid request to opt out of sale/share of Personal Information and of targeted advertising for the browser sending the signal (see Section 6.2).

We use third-party analytics services on the Platform and related Services to better understand End User online activity. These service providers collect information about End User’s use of our Platform and related Services and other websites and online services over time through cookies, device identifiers, pixel tags, or other tracking technologies. We and our third-party providers use this information to, among other things, analyze and track data, determine the popularity of particular content, and deliver advertisements based on your interests on our Platform, as well as to provide services to us, such as reporting, analytics, and market research.

2.3. Information We Collect from Other Sources

We may collect information about our Customers at the hotel-level from other sources to supplement the information we collect directly from you. For additional information regarding our collection and use of business information related to Customers, please see Section 9 (Additional Notes on Business Information).

3. How We Use Your Information

Lilo may use Personal Information we collect in the following ways:

To provide the services you have requested, such as to verify a purchase, offer customer support, facilitate cash-back and redemption offers in which you chose to participate, and investigate and respond to your inquiries.
To communicate with you, for example, keeping you posted on purchases, shipments, and changes to our terms, conditions, and policies.
For marketing and advertising purposes, including providing Customers with the latest and most relevant product announcements and promotions. For example, we may utilize information provided to us to ensure that we’re showing our Customers relevant ads on the Platform, and to measure the effectiveness and reach of those ads. We may also utilize Personal Information associated with End Users of a Customer to administer loyalty programs and cashback campaigns on behalf of our Vendors.
To improve our Services and Platform, including bug detection and error reporting, to understand how End Users interact with the Services and Platform, to improve the usability and effectiveness of our products, perform research and analytics, and to test and create new products, features, and services.
For security and other general business operations, such as to maintain the safety, security, and integrity of the Platform, detecting security incidents, and investigating and protecting against malicious, deceptive, fraudulent, or illegal activity.
To facilitate mergers and acquisitions, such as to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about users of the Platform and Services is among the assets transferred.
For legal and compliance, such as to comply with applicable laws including Privacy Laws, including verifying age and other legal requirements when necessary; facilitating any required reporting for substances designated as controlled at either the state or federal level; complying with legal processes; responding to requests from public and government authorities; meeting national security or law enforcement requirements; enforcing our terms and conditions applicable to you (“Terms of Use"); protecting our operations; protecting the rights, privacy, safety, or property of Lilo and users of the Platform and Services and other relevant individuals; and allowing us to pursue available legal remedies and limit the damages that Lilo may sustain.
In accordance with your consent. We may also use your Personal Information for a specific purpose that we communicate to you. We will ask for your consent to process your Personal Information for such purpose in accordance with applicable legal requirements. We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

For the purposes discussed in this Privacy Policy, we may combine the Personal Information that we collect through the Services with information that we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.

Use of Sensitive Personal Information. Where we collect SPI (e.g., account log‑in plus password/PIN, precise geolocation where enabled, or call recordings for quality assurance), we use it only as necessary for the services (such as authentication, security, fraud prevention, and customer support), and not to infer characteristics about you.

4. How We Disclose Your Information

Lilo may disclose Personal Information for a business purpose in the following ways:

Authorized third-party service providers. We use select third-party service providers to help us provide the Services and to operate our business. They provide a variety of services to us, including fulfillment, shipping and delivery, customer service, web hosting and design, payment processing, sales and marketing, data storage, analytics and related services, security, fraud prevention, research, and legal advising or consulting services. We share information with vendors and our fulfillment partners for the purpose of ensuring the delivery of the purchased product or requested services.
Vendors. We may disclose the information we collect about you to vendors that have a business relationship with us and some of whose products you purchase through the Platform and Services. For example, for orders with vendors through the Platform, we may share your account information, including, for example, your business details, with the respective vendor to process and ship the order, as well as to communicate directly with you for troubleshooting, order issues, errors, or other investigations. For free samples, we may share your Personal Information with the vendor providing those samples, so that the vendor can communicate with you regarding your experience with their product(s).
Customers. For End Users associated with a Customer, this includes providing the owner or manager of the associated Customer with information regarding redemption rewards or cashback redeemed by End Users; account information for modifying user access and permissions; clarifying or removing duplicate accounts; confirming the account information associated with a purchaser for certain orders placed on the Platform.
Legal purposes. We may disclose information we collect about you if required to do so by law or applicable regulations, or in a good faith belief that such disclosure is reasonably necessary to: (a) comply with legal process (for example, a subpoena or court order); (b) enforce our Terms of Use, this Privacy Policy, or other contracts with you, including investigation of potential violations; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of us or others.
Regulatory purposes. We may be required to share certain information with third parties to fulfill our regulatory obligations. This may include, but is not limited to, providing information to manufacturers for reporting product issues or to assist any of our manufacturer or vendor partners in the event of a product recall. Additionally, we may need to provide information to regulatory authorities or compliance bodies as required by law or regulation. This ensures that we meet all legal requirements and maintain the safety and integrity of the products we supply to our clients.
Business transfers. As we continue to develop our business, we may engage in transactions with other companies regarding the purchase or sale of a business. We may disclose your information to the extent necessary and under confidentiality obligations as part of, or in contemplation of, such transactions.

Account Transfers Between Representatives. If your company designates a new authorized representative, we may transfer the minimum necessary account information upon written confirmation from the Customer and after we verify authority. We log such transfers for audit.

5. Security and Retention of Your Information

5.1. Security of Your Information

We are committed to protecting your information. We use a variety of technical, physical, and organizational security measures designed to protect against unauthorized access, alteration, disclosure, or destruction of information. However, no security measures are perfect or impenetrable. As such, we cannot guarantee the security of your information.

When creating an account on the Platform, it is important that you select a strong and unique password and do not disclose it to others. Alert us immediately if you have any concerns about unauthorized use of your account.

5.2. Retention of Your Information

We retain information for different periods of time depending on the purposes for which we collect and use it, as described in this Privacy Policy, and as required or permitted by law. The criteria we use to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the Platform and Services; (ii) legal obligations to which we are subject (e.g., tax, accounting, and audit); and (iii) whether retention is advisable considering our legal position (such as for statutes of limitations, litigation, or regulatory investigations).

Category‑level retention (typical):

Category	Examples	Typical Retention
Identifiers & account data	Name, business email, login, role	Life of account + up to 2 years
Commercial information	Orders, carts, invoices	Up to 7 years (tax/audit)
Internet/usage data	Logs, analytics events	12–24 months
Customer service records	Tickets, call recordings	Up to 2 years
Payment information (non‑PAN tokens)	Payment token IDs, last four digits	Life of account + up to 2 years
Security & fraud data	Auth logs, risk flags	Up to 24 months

Subject to the foregoing, when you delete your account, we may delete or anonymize content you have posted on the Platform, such as your reviews or Q&A activity, except where retention is required by law or necessary to protect our rights.

6. Your Rights and Choices

We provide you with the ability to exercise certain controls and choices regarding our collection, use, and disclosure of your information. Your legal rights vary based on applicable Privacy Laws.

6.1. Access, Deletion, Correction, and Portability

You may request to know/access the Personal Information we maintain about you, to delete it, to correct inaccuracies, and to obtain a portable copy. Submit a request by emailing support@lilohq.com. We will respond within 45 days (with a possible 45‑day extension where permitted). We will take steps to verify your request (e.g., by confirming control of your account or email address).

6.2. Do Not Sell or Share My Personal Information; Targeted Advertising; GPC

We do not sell Personal Information for money. We may share Personal Information for cross‑context behavioral advertising under California law and may engage in “sale” or “targeted advertising” as defined by certain State Privacy Laws when we use advertising/targeting cookies or similar technologies.

You can opt out of sale/share/targeted advertising at any time by emailing support@lilohq.com with the subject line “Privacy Opt‑Out.” We also honor the Global Privacy Control (GPC) signal as a valid request to opt out for the browser sending the signal.

6.3. Cookie Controls

You can manage cookies in your browser settings. To request an advertising opt‑out (sale/share/targeted advertising), email support@lilohq.com with the subject line “Privacy Opt‑Out.” If you delete cookies, use a different browser, or change devices, you may need to reapply your preferences.

6.4. Limit the Use of Sensitive Personal Information (where available)

Where required by law (e.g., California), you may limit our use and disclosure of SPI to only those purposes necessary to provide the services and for security and integrity. You can exercise this by contacting support@lilohq.com.

6.5. Authorized Agents; Appeals; Non‑Discrimination

Authorized agents. You may authorize an agent to submit a request on your behalf. Agents must provide proof of authority (e.g., power of attorney or signed permission) and we may require you to verify your identity directly with us.
Appeals. If we deny your request, you may appeal by replying to our decision email. We will respond within 45 days with an explanation of our decision. If your appeal is denied, you may contact your state Attorney General.
Non‑discrimination. We will not discriminate or retaliate against you for exercising any privacy rights, including by denying goods/services, charging different prices, or providing a different level or quality of services, except as permitted in connection with financial incentive programs (see Section 10).

6.6. Account Profile & Communications

Account Profile: You may update certain account profile information by logging into your account. For example, you may modify your personal information, position, password, address, and payment information through the Account tab of the Platform. To deactivate your account, email support@lilohq.com. You may also manage user accounts or permissions for other End Users within your company, subject to appropriate authorization.
Communication preferences: You may modify or update your communication methods via your account on the Platform or opt out of non‑essential marketing communications by following opt‑out instructions in the message or via account settings.

7. Changes to Our Privacy Policy

We reserve the right to amend this Privacy Policy at our discretion and at any time. When we make changes, we will post the updated version on the Platform and update the revision or effective date at the top of this Privacy Policy. Your continued use of the Platform and Services following the posting of changes constitutes your acceptance of such changes.

8. Contact Us

If you have any questions or comments about this Privacy Policy, the way in which Lilo collects and uses your information described here, your choices and rights regarding such use, or wish to exercise your rights in relation to your Personal Information, please contact us using any of the methods below:

Privacy Requests: Email support@lilohq.com for any privacy request, including opt‑outs.
Email: support@lilohq.com
Postal Address:

Torpedo Now, Inc.
Attn: Legal Department
1207 Delaware Ave. #1686, Wilmington, DE, 19806

If you need to access this Privacy Policy in an alternative format due to having a disability, please contact us using any of the methods listed in this section.

9. Additional Notes on Business Information

De‑Identified Information. We may de‑identify information we collect so that it cannot reasonably identify you, your device, or your affiliated Customer, or we may collect information that is already in a de‑identified form. When we maintain de‑identified information, we will not attempt to re‑identify it (except solely to test whether our de‑identification processes satisfy applicable standards), we will maintain it using reasonable technical and organizational safeguards, and we will require recipients of de‑identified information to do the same.

Business‑to‑Business Information. Lilo may obtain business information directly from you or from other third‑party sources. For example, when a Customer connects with a vendor through the Platform, Lilo may receive from the vendor, or retrieve on the Customer’s behalf and as the Customer’s authorized agent, information about the Customer’s prior purchases (including products, quantities, and frequency of prior orders at the hotel level). Lilo may also collect information regarding your affiliated hotel’s purchasing and purchasing trends at the hotel level by virtue of End Users’ use of the Platform. Lilo may use or disclose such business information in the following ways:

Vendors: Lilo may use and disclose information that pertains to Customers to facilitate vendor integrations on the Platform, including by sharing which items are added to or removed from carts, or changing desired quantities in shopping carts. Additionally, for products purchased from a particular vendor, we may share with that vendor hotel purchasing volume or sales volume for that vendor’s products to comply with contractual obligations or for marketing purposes. This may include sharing enrollment and participation in any cashback or loyalty programs, and the total amount of rewards or redemptions claimed on a per‑hotel basis; sharing information for the purposes of determining eligibility for particular cashback or loyalty offers; providing reports to vendors regarding order data for the vendor’s products; and sharing information regarding past purchases and pricing of particular products with the manufacturing vendor of those products to confirm pricing accuracy. Beyond confirming pricing for select products with the vendor that manufactured those products, we will not share pricing information with any third parties.
Data Analytics: Lilo may share data analytics based on de‑identified Customer information with vendors and other industry partners. This information may include data such as total product sales in a particular region or rate of lapse for particular products. The purpose of sharing this aggregated information is to identify market trends and improve overall service provided to hotels. In addition, we may share the fact that your affiliated Customers conduct purchasing through the Platform or otherwise use the Platform and Services with (a) vendors; or (b) in the event that your affiliated Customer is associated with a larger corporate group, with your associated corporate.

For business‑to‑business information that does not constitute Personal Information as defined herein, nothing in this Privacy Policy shall be deemed to limit Lilo’s use or disclosure of such information, subject to the terms of any services or other agreement between Lilo and the applicable third‑party business.

10. Notice of Financial Incentive

From time to time, we may offer loyalty, cashback, referral, or similar programs (collectively, “Programs”) that may be considered financial incentives under certain laws.

Participation is voluntary and requires your opt‑in. You may opt out at any time by contacting support@lilohq.com; opting out will not affect your ability to use the Platform.
Categories of Personal Information involved: identifiers (e.g., name, email, account ID), commercial information (e.g., items purchased, amounts, redemption history), and program engagement metrics.
How we use the information: to administer Programs, prevent fraud, determine eligibility, and provide offers.
Value of the incentive: We make a good‑faith estimate of the value of your data to our business based on Program costs and expected redemption/engagement, which may vary by Participant and Program. We calculate this using the expense related to the offer (e.g., cashback percentage) and the anticipated revenue/benefit from increased engagement.
Non‑discrimination: We will not unlawfully discriminate against you for exercising privacy rights. However, different prices, rates, or quality levels may be offered in connection with your voluntary participation in a Program, to the extent permitted by law.