Privacy Policy

the operator of LootMerchants is the data controller for the personal data described here. For anything in this policy, including a request to exercise the rights below, write to legal@example.com.

The categories below are what an account generates in normal use. They describe the shape of what we hold rather than an exhaustive field-by-field inventory:

• Account - your email address and display name, plus a profile image where your sign-in provider supplies one. If you sign in with one of the social providers offered rather than a password, we receive the same basic profile details from that provider; there is no way to upload a profile image yourself.
• Security - sessions, including the IP address and the browser or device information recorded with each sign-in, which we keep to spot account takeover and abuse; and, where you enable them, two-factor secrets and passkeys.
• Trading - your orders, offers, escrow and wallet balances, payouts, seller rank, and reviews you write or receive.
• Things you submit - messages to the other side of a trade, listing images, delivery proof, and evidence you attach to a dispute. Files you upload - listing images, delivery proof, and dispute evidence - are stored at their own web link. That link is long and random, so it cannot be guessed, but it does not require signing in: anyone who has the link can open the file, and can pass it on. Please do not upload anything you would not want seen by someone holding the link.
• Operational records - notifications we sent you, and an audit record of administrative actions taken on your account or orders.

We do not receive or store your card number or your wallet credentials. Card details go directly to Stripe, and where you choose to pay in cryptocurrency the payment is completed on CoinGate.

• To perform our contract with you - running your account, processing orders, holding escrow, paying sellers, and handling disputes. Without this data there is no way to run a trade.
• To meet legal obligations - accounting and tax records, and anti-fraud and identity checks required of payment services.
• For our legitimate interests - keeping the marketplace safe: detecting fraud, investigating reports, and enforcing our terms. You can object to processing on this basis, and we will stop unless we have grounds that override your objection.

We use a small number of providers, each doing one job. They act on our instructions and may not use your data for their own purposes. The main ones are:

• Stripe - payments, payouts, and the identity checks required to pay a seller. Stripe is an independent controller for parts of this and has its own privacy policy.
• Neon - the database holding your account and trading records.
• Vercel - hosting, and the file storage behind everything you upload. Files there are served from a public content address rather than from behind our sign-in, as described above.
• CoinGate - processing crypto payments, where you choose that payment method at checkout. We pass it the order it relates to; the payment itself is completed on CoinGate under its own privacy policy.
• Resend - sending transactional email such as order confirmations and dispute notices.
• Upstash - where rate limiting is enabled, the counters that stop actions such as checkout or withdrawal being repeated abusively. It receives your account identifier and the name of the action, and nothing else about you.

We do not sell your personal data, and we do not share it for advertising.

When you trade, the other party sees your display name, the profile image your sign-in provider supplied if there is one, seller rank and reviews where you are the seller, and the messages you send them, along with anything else you choose to put in front of them in the course of the trade. What they do not see is your email address, and payouts do not expose your bank details to the other side.

Account and trading records are kept while your account is open. Closure is by request to legal@example.com and requires open orders to be settled first; after an account closes we keep what we need for accounting and to defend claims, and remove the rest. Records tied to a completed payment are kept for the period required by tax and accounting law rather than deleted on request.

Dispute evidence is kept for as long as the dispute could be reopened or escalated.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable form. You can object to processing we do on the basis of legitimate interests, and withdraw consent where we relied on it.

Write to legal@example.com and we will respond within one month. If you are not satisfied you can complain to your national data protection authority.

We set a cookie to keep you signed in, and signing in with a social provider sets short-lived cookies that exist only to complete that exchange securely. All of them are necessary for the site to work and none is used to track you across other sites. We do not run advertising or analytics cookies.

If this policy changes we update the date at the top, and we tell you directly where the change materially affects your rights.