Politikerezh prevezded

This policy explains what personal data LootPay processes, why, for how long and what rights you have. The controller is LootPay’s operator named on the legal notice page. For privacy questions write to [email protected].

What we process and why

• Account: username, email, password (stored only as an argon2id hash), language. To run your account and send sign-in codes — contract (GDPR art. 6(1)(b)).
• Sessions: a session cookie, IP address and browser name of each signed-in device, kept for up to 30 days of inactivity. To keep you signed in and protect accounts — contract and legitimate interest in security (art. 6(1)(f)).
• Seller details: name, date of birth, address, tax number; for businesses also registration number, VAT number, phone and email. Stored encrypted. Required by EU law for marketplaces (Digital Services Act; DAC7 tax reporting) — legal obligation (art. 6(1)(c)). Business sellers’ name, address and contacts are shown to buyers.
• Marketplace activity: your listings, deals, deal messages, reviews and reports. To provide the marketplace, resolve disputes and keep records the law requires — contract and legal obligation.
• Support email: messages you send to addresses at lootpay.eu. To answer you — contract or legitimate interest.
• Security and reliability: rate limits by IP address, a bot check on sign-in and sign-up (Cloudflare Turnstile), technical logs and error reports. Legitimate interest in keeping the service secure and working.

We do not sell personal data, do not use advertising or tracking cookies and do not make automated decisions with legal effect about you.

Cookies

We use only cookies needed for the service: the session cookie and your choice of currency. No consent is needed for them, so there is no cookie banner.

Who receives data

• OVHcloud — hosting of our servers and database in the EU.
• Cloudflare — network delivery, protection against attacks, the bot check and our email. Cloudflare may process data outside the EU under the EU–US Data Privacy Framework and standard contractual clauses.
• The payment provider — when payments are enabled, payment data goes directly to it; we do not store card details.
• Other users — your username, listings, reviews and, for business sellers, the details EU law requires to show.
• Authorities — tax authorities for DAC7 reports, and authorities with a lawful request.

Our logs and error reports are stored on our own servers, not with third parties.

How long we keep data

• Account data — until you delete the account. After deletion your username and email are removed; deals, payouts and seller details needed for tax reporting are kept as long as the law requires (generally 5 to 10 years).
• Sign-in codes — 24 hours; sessions — up to 30 days of inactivity.
• Technical logs — 30 days; error reports — 90 days.

Your rights

You can access, correct, delete, restrict and port your data and object to processing based on legitimate interest. You can download all your data and delete your account yourself on the Account page; for anything else write to [email protected]. You can also complain to a data protection authority, for example in the country where you live.

Security

Connections are encrypted (TLS), passwords are hashed with argon2id, every sign-in is confirmed by a code from your email, and seller details are encrypted at rest (AES-GCM).

Changes

We will tell you by email about important changes to this policy.