Privacy policy

Last updated: November 2026

LOOT is committed to protecting your personal data. This policy explains what we collect, why we collect it, and how we use it.

1. What we collect

• Your name, email address, and city when you sign up
• Which cards and memberships you tell us you hold (entered manually — we never connect to your bank)
• Offers you spot or verify as a Scout, and your credit balance
• Onboarding progress: which steps you reach when you join (for example, whether you picked your cards or saw the £19 offer), so we can find and fix the places where people get stuck. We also keep an anonymous daily count of landing page visits, with no cookie and no personal identifier.
• Payment data is processed by Stripe and never stored on our servers. We only receive a customer ID confirming the transaction.
• Advertising details, only if you accept Marketing cookies: the ad click ID and campaign tags from the link you arrived on, your Meta browser ID, and your IP address and browser type when you sign up. We use these to see which ads lead to sign ups and purchases.

2. How we use it

• To show you personalised offers matched to your declared wallet
• To rank you on the Scout leaderboard (using your city)
• To send you your magic-link sign-in email
• To contact you about your account or material changes to LOOT (rarely, and only when relevant)
• We never sell your data to third parties. We only use it for advertising measurement if you accept Marketing cookies (see section 5)

3. Open Banking

LOOT does not currently use Open Banking. You manually tell us what cards and memberships you hold — we do not connect to your accounts, read your balance, or initiate payments. If we ever add Open Banking, it will be opt-in, read-only, and fully regulated under FCA rules.

4. Data storage and security

Your data is stored in Supabase on servers within the EU (Ireland region). Supabase is ISO 27001 certified and SOC 2 Type II compliant. All data is encrypted in transit (TLS) and at rest (AES-256). Access is restricted to the LOOT team only.

5. Cookies and advertising

Essential cookies. These keep you logged in and remember your cookie choice. We always use them, because the app can’t work without them.

Marketing, only if you say yes. With your permission, we use the Meta Pixel and Meta’s Conversions API to see which of our ads lead to sign ups and purchases, and to show LOOT to people who might enjoy it. Meta receives details such as the pages you view and your browser type. When you create an account or pay, we also send Meta your email address in hashed (scrambled) form, along with the event itself, for example “purchase”. To keep this accurate when you open your sign-in email in a different browser, we save the ad click details on your account when you sign up, and we use them for these events.

If you reject. We load nothing from Meta and send Meta nothing. LOOT works exactly the same.

Changing your mind. Open “Cookie settings” in the footer at any time to switch marketing on or off. Meta’s own use of the data it receives is covered by Meta’s privacy policy.

6. Your rights under UK GDPR

• Access — request a copy of the data we hold about you
• Correction — update or correct any inaccurate data
• Deletion — request that we delete your account and all associated data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to us processing your data in certain circumstances

To exercise any of these rights, email privacy@lootapp.app. We will respond within 30 days.

7. Data retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain it (e.g. financial records).

8. Third-party services

• Supabase — database and authentication
• Stripe — payment processing
• Vercel — hosting and edge delivery
• Resend — email delivery. It carries the notifications we send our own team, for example when you send us a message or cash out credits, which include the details you submitted
• Meta — advertising measurement, only if you accept Marketing cookies (see section 5)

Each of these providers has their own privacy policy and is bound by GDPR-compliant data processing agreements with us.