Privacy policy

Last updated: June 2026

LOOT is committed to protecting your personal data. This policy explains what we collect, why we collect it, and how we use it.

1. What we collect

• Your name, email address, and city when you sign up
• Which cards and memberships you tell us you hold (entered manually — we never connect to your bank)
• Offers you spot or verify as a Scout, and your credit balance
• Usage data (pages visited, features used) to improve the product — collected anonymously via Vercel Analytics
• Payment data is processed by Stripe and never stored on our servers. We only receive a customer ID confirming the transaction.

2. How we use it

• To show you personalised offers matched to your declared wallet
• To rank you on the Scout leaderboard (using your city)
• To send you your magic-link sign-in email
• To contact you about your account or material changes to LOOT (rarely, and only when relevant)
• We never sell your data to third parties, and we never use it for advertising

3. Open Banking

LOOT does not currently use Open Banking. You manually tell us what cards and memberships you hold — we do not connect to your accounts, read your balance, or initiate payments. If we ever add Open Banking, it will be opt-in, read-only, and fully regulated under FCA rules.

4. Data storage and security

Your data is stored in Supabase on servers within the EU (Ireland region). Supabase is ISO 27001 certified and SOC 2 Type II compliant. All data is encrypted in transit (TLS) and at rest (AES-256). Access is restricted to the LOOT team only.

5. Cookies

We use essential session cookies only — these keep you logged in between visits. We do not use advertising cookies, tracking pixels, or third-party analytics that profile you personally.

6. Your rights under UK GDPR

• Access — request a copy of the data we hold about you
• Correction — update or correct any inaccurate data
• Deletion — request that we delete your account and all associated data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to us processing your data in certain circumstances

To exercise any of these rights, email privacy@loot.app. We will respond within 30 days.

7. Data retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain it (e.g. financial records).

8. Third-party services

• Supabase — database and authentication
• Stripe — payment processing
• Vercel — hosting and edge delivery

Each of these providers has their own privacy policy and is bound by GDPR-compliant data processing agreements with us.