Privacy policy

Lollipop is a check-in service that employers use with their teams. It is operated by Nixar Solutions (“we”). This policy covers the check-in texts, WhatsApp messages, emails, Slack messages and Microsoft Teams chats, the check-in page, and the staff dashboard.

What we collect

• From your employer: your name, mobile number or email address, team, role and language, so check-ins can reach you.
• From you: what you put in a check-in: a mood from 1 to 5, feelings you tap, a note, an answer to the day’s question, whether you want a follow-up, and anything you text or message back.
• Automatically: when a check-in was sent, opened and answered, and what the text, WhatsApp or email provider reports about delivery. Staff who sign in get one cookie that keeps them signed in. There are no advertising or analytics trackers.

How we use it

• To send check-ins at your team’s check-in times, and one reminder if you haven’t answered.
• To tell your manager when a check-in is low, when you ask for a follow-up, or when a pattern of low check-ins appears.
• To send notes that mention something serious, such as harassment, injury or self-harm, to HR and company admins, not your manager.
• To read what your notes and replies are mostly about, such as stressed or upbeat, whichever way they reach us (the check-in page, a text, WhatsApp or Slack). Staff see it with your check-in and in the weekly summary. The words, the mood, the day’s question and the language are sent to an AI classification service, TypeSafe, for that purpose. Your name and contact details are not, and neither is a note that mentions something serious.
• To send managers a weekly summary and to show the dashboard.

Who sees what

Check-ins are named, not anonymous, so someone can act on them. Managers see their own team. HR and company admins see the whole company. A note that mentions something serious goes to HR and company admins, not your manager; the manager sees that a note exists, not what it says.

Who we share it with

Only the services that run Lollipop: a database host (Supabase, United States), a text message carrier (Twilio), WhatsApp (Meta, when your employer turns it on), an email provider (Resend), Slack (when your employer connects it), Microsoft Teams (Microsoft, when your employer connects it), a web host (Netlify), a payment processor (Stripe, which gets your employer’s billing details, not yours) and the AI classification service described above (TypeSafe). Each receives only what it needs to do its part. We do not sell personal information and we do not use it for advertising.

Mobile information and text message opt-in data and consent will not be shared with or sold to third parties or affiliates for marketing or promotional purposes. The sharing described above excludes this information.

Customers in the European Union

Lollipop’s database is in the United States, and the services above process personal data there. If your employer is in the European Union, the data of its people is transferred to and processed in the United States by these processors. Employers can ask us for a data processing agreement at jeff@trylollipop.com.

Text messages

Texts come from your employer through Lollipop: up to 2 check-ins a week, each with at most one reminder. Message and data rates may apply. Reply STOP to stop and HELP for help; the full text message terms are separate.

WhatsApp

If your employer turns WhatsApp on, your check-ins can come as WhatsApp messages from Lollipop’s WhatsApp Business number, and you answer there. An admin confirms on Settings that the people set to WhatsApp agreed to get work check-ins on it before any are sent.

• What we receive: the messages you send the Lollipop number, whether each message we sent you was delivered, and whether your number is on WhatsApp. Photos, voice messages, files and locations are not kept; your record only notes that one came in.
• Who handles it: the messages go through the WhatsApp Business Platform, run by Meta Platforms. Meta receives your mobile number and the words of each message, which include your first name and your employer’s name, and handles them under WhatsApp’s business terms and its own privacy policy. Meta gets nothing else from Lollipop.
• No marketing: on WhatsApp, Lollipop sends only check-ins, replies to your answers and, if you are a manager, alerts about your team’s check-ins. WhatsApp numbers and opt-in data will not be shared with or sold to anyone for marketing or promotional purposes.
• How long: your WhatsApp messages are kept and deleted with the rest of your check-ins, as described below.

Slack

If your employer connects Slack, your check-ins can come as a direct message from the Lollipop app, and you answer there.

• What we read: for the people in a channel an admin picks, the name, work email address and phone number on their Slack profile, and who is in that channel. The direct messages you send the Lollipop app. Nothing from channels, and no other messages.
• What it’s for: to send you check-ins as direct messages from the Lollipop app and read your answers, and to keep a team in step with its channel as people join and leave it.
• How it’s stored: the workspace’s Slack token is stored encrypted. Your Slack id is kept on your record so messages reach you.
• How long: when an admin disconnects Slack on Settings, or the Lollipop app is removed in Slack, the token is revoked and we forget it. Your Slack id stays on your record until you are deleted.
• Questions: write to us at jeff@trylollipop.com.

Microsoft Teams

If your employer connects Microsoft Teams, your check-ins can come as a chat from the Lollipop app in Teams, and you answer there.

• What we read: for the people on a Teams team or channel an admin picks, the name and work email address on their Microsoft 365 account, and who is on that team. The messages you send the Lollipop app in your chat with it. Nothing from channels, and no other messages.
• What it’s for: to send you check-ins as chats from the Lollipop app and read your answers, and to keep a team in step with its Teams team as people join and leave it.
• How it’s stored: Lollipop keeps your employer’s tenant id and signs in to it with its own credentials; no token of yours or your employer’s is stored. Your Microsoft 365 account id and the id of your chat with the app are kept on your record so messages reach you.
• How long: when an admin disconnects Microsoft Teams on Settings, we forget the tenant, and your employer can remove the app’s permissions in Microsoft Entra. Your account id stays on your record until you are deleted.
• Before your employer connects it: if you message the Lollipop app in Teams first, it answers that your organization hasn’t set it up yet. Nothing you send it is kept.
• Questions: write to us at jeff@trylollipop.com.

How long we keep it

For as long as your employer’s account is active, so that managers can see history and follow-through. Your employer’s admins can deactivate you, or delete you and your check-ins, on your page in Lollipop, and the company’s owner can delete the whole company on Settings. Your employer can also ask us to delete your records. Write to us at the address below for a copy of your check-ins. To have your records deleted, follow the steps on deleting your data.

Your choices

• Reply STOP to any text to stop texts to that number. Reply START to get them again.
• Reply STOP on WhatsApp to stop WhatsApp messages; your check-ins then come by text or email instead. Reply START on WhatsApp to switch back.
• If your employer has your email, sign in with it to change your language and how check-ins reach you.
• Ask your employer to switch you to email, to deactivate you, or to delete you and your check-ins.

Security

Everything travels over encrypted connections. Each check-in link is unique and hard to guess. It opens that check-in until it closes, 3 days after it was sent or answered; after that it shows nothing about you. Staff sign in with a one-time email link, never a password. Access is limited by role.

Children

Lollipop is for workplaces and is not meant for anyone under 16.

Changes and contact

When this policy changes, the date at the top changes. Questions, requests for your data, or deletion requests: jeff@trylollipop.com.