Privacy Policy | LOOT Legal

This Privacy Policy explains how LOOT ("LOOT", "we", "us", or "our") collects, uses, discloses, and protects personal information when you use LOOT websites, mobile apps, APIs, dashboards, creator tools, brand tools, wallets, campaign workflows, media processing, support channels, and related services (the "Services").

LOOT is operated from the United States and offered worldwide. If you do not agree with this Privacy Policy, do not use the Services.

1. Who This Policy Covers

This policy applies to:

Creators who create profiles, connect social accounts, upload creative, join campaigns, submit content, receive invites, and receive payouts.
Brands, agencies, and organization members who create workspaces, invite teams, discover creators, create campaigns, review submissions, and fund campaigns.
Visitors to our website or public pages.
Anyone who contacts us, interacts with support, or uses our Services.

2. Information We Collect

We collect information you provide, information created when you use LOOT, and information from service providers and integrations.

Account and Authentication Information

Name, email address, phone number, username, profile image, login identifiers, Privy user ID, linked authentication methods, session metadata, consent records, onboarding state, and account settings.

Creator Profile Information

Username, display name, avatar, country, city or region, age or birth year, gender, language, niches, areas of focus, portfolio links, uploaded portfolio media, social handles, self-reported creative output, earnings goals, campaign preferences, and wallet status.

Brand, Agency, and Organization Information

Organization name, business type, website, country, logo, description, team member emails, roles, campaign data, creative briefs, reference media, invite messages, and workspace settings.

Campaign, Submission, and Marketplace Information

Campaign applications, invites, roster membership, submission media, submission links, captions, campaign messages, review decisions, approval status, revision notes, performance metrics of submitted posts, payout rules, payout calculations, payout events, and related audit logs.

Media and Content

If you upload images, videos, screenshots, files, creative briefs, references, or other content, we collect the file, metadata, processing status, captions and transcripts generated during processing, thumbnails, previews, public URLs where applicable, and moderation or review data.

Wallet and Onchain Information

Wallet addresses, wallet type, linked wallet identifiers, chain information, token symbols, transaction hashes, funding events, payout events, balances displayed through supported providers, network metadata, and fraud or risk signals. Public blockchain information may be visible to anyone and may not be erasable by LOOT.

If you connect a social account (for example TikTok, Instagram, Facebook, or X) or submit a public post link, we may collect: the platform, your handle and platform account ID, profile metadata, OAuth authorization data and granted scopes, post URLs and platform post IDs, captions, publish dates, connection status, and performance metrics of the posts you submit (such as view counts and like counts). Access tokens and secrets are encrypted, stored with additional access controls, and used only for the authorized integration.

See Section 7 (How We Use Social Platform Data) for purpose limitations and Section 12 (Disconnecting Accounts and Data Deletion) for how to disconnect and request deletion.

Identity Verification and Compliance Information

Where required for payouts or by law, we may collect identity verification information, tax-related information, sanctions screening results, and fraud-prevention signals. Where identity verification is performed by a specialized provider, that provider may process identity documents under its own privacy terms.

Device, Usage, and Technical Information

IP address, device identifiers, app version, operating system, browser, approximate location from IP, crash logs, request logs, diagnostic events, performance data, feature usage, referral source, cookie or SDK identifiers, and security events.

Communications and Support

Messages you send to us, support requests, feedback, emails, and records of our responses.

3. How We Use Information

We use information to:

Provide, operate, maintain, and improve the Services.
Authenticate users and keep accounts secure.
Create creator, brand, agency, individual, and organization workspaces.
Match creators with campaigns and brands.
Let brands discover creators, send invites, manage rosters, and review submissions.
Let creators join campaigns, upload creative, submit links, and receive payouts.
Calculate campaign earnings according to the applicable campaign payout rules, including flat approved-submission payouts and performance-based payouts when those features are enabled and verified.
Process media into previews, thumbnails, captions, and translations.
Support wallet setup, wallet status checks, campaign funding, and payout workflows.
Verify identity and eligibility where required for payouts or compliance.
Send service messages, security alerts, product updates, support replies, and optional marketing messages.
Detect, prevent, and investigate spam, fraud, abuse, unauthorized access, metric manipulation, platform manipulation, or illegal activity.
Moderate content and enforce our Terms, Program Terms, Community Guidelines, and Copyright Policy.
Analyze usage and improve product quality.
Comply with laws, legal process, regulatory requests, and contractual obligations.

4. Legal Bases For Processing

Where a legal basis is required, we process personal information based on: contract (to provide the Services and enforce our Terms); legitimate interests (to secure, improve, analyze, and protect the Services and marketplace); consent (when you authorize social connections, optional marketing, certain cookies, or other optional data uses); legal obligation (law, legal process, tax, fraud, safety, copyright, sanctions, or regulatory requirements); and vital or public interests where applicable and legally permitted.

We may share information with:

Other LOOT users as needed for the marketplace. Brands may see creator profiles, portfolio media, submissions to their campaigns, application details, and the performance metrics of posts submitted to their campaigns. Creators may see brand names, logos, campaign details, invite messages, and payout rules.
Service providers that host, process, secure, monitor, or support the Services, including cloud hosting, database, media processing, content delivery, authentication, wallet infrastructure, analytics, email, support, identity verification, and monitoring providers.
Privy and wallet-related providers for authentication, embedded wallets, organization-authorized wallets, wallet status, and related wallet infrastructure.
Social platforms and their APIs when you connect an account or ask us to retrieve or verify social content.
Payment, wallet, legal, tax, compliance, and fraud-prevention providers when needed for funding, payouts, security, or compliance.
Professional advisors, auditors, insurers, and legal representatives.
Authorities, courts, regulators, or third parties when required by law, necessary to protect rights and safety, or needed to enforce our agreements.
Buyers, successors, or affiliates in connection with a merger, acquisition, financing, reorganization, asset sale, or similar transaction.

We do not sell your personal information for money. If we ever engage in activity considered a "sale" or "sharing" under applicable US state privacy law, we will provide required notices and choices.

6. Public and Marketplace Visibility

Some information is visible to other users or the public by design:

Creator usernames, display names, avatars, location signals, niches, portfolio media, public links, and marketplace stats may be visible to brands or agencies.
Performance metrics of a post you submit to a campaign are visible to that campaign's owner. Brands do not receive whole-account analytics for your connected accounts; visibility is limited to the posts you submit.
Brand names, logos, campaign names, invite messages, payout rules, and campaign details may be visible to invited or enrolled creators.
Public social posts and public wallet addresses remain public outside LOOT.
Media marked public or used in marketplace previews may be served through public URLs or a content delivery network.

Do not upload content or include information in your profile, campaign, brief, invite, submission, or message that you do not want shared with the intended audience.

When you connect a social account, LOOT accesses your account's data through the platform's official API, under the permissions you grant, and only for the following purposes:

Verifying that you own the connected account.
Displaying the content you submit in campaign contexts (for example, campaign galleries).
Showing performance metrics of submitted posts to you and to the owner of the campaign you submitted to.
Calculating campaign earnings from those metrics when the applicable campaign payout rule depends on verified performance data.
Detecting fraud, metric manipulation, and policy violations.

We do not sell social platform data, do not use it for third-party advertising or surveillance, do not access posts you have not submitted beyond what is needed for account connection and verification, and do not retain platform data longer than needed for the purposes above and our legal obligations. Aggregated, de-identified campaign statistics may be used for reporting and product features.

8. Wallets and Blockchain Data

LOOT uses wallet infrastructure providers such as Privy. Wallets on LOOT come in two forms:

Creator wallets. Creators receive payouts to an embedded self-custodial wallet provisioned for them or to an external wallet they connect. Unless a feature expressly states otherwise, LOOT does not control the private keys of creator wallets.
Organization wallets. Brand and agency workspaces may use organization-authorized wallets provisioned through wallet infrastructure providers. LOOT applies campaign policy controls in our systems, including wallet readiness checks, campaign budget checks, transaction limits where supported, approval rules, and audit logging. Unless a feature expressly states otherwise, LOOT does not control the private keys of organization wallets.

Blockchain transactions are generally public, irreversible, and outside LOOT's ability to delete or modify. Your wallet address and transaction activity may reveal information about you when combined with other data.

9. Cookies, SDKs, and Similar Technologies

We and our providers may use cookies, local storage, mobile SDK storage, device identifiers, and similar technologies to keep you signed in, secure the Services, remember preferences, measure usage, improve performance, and support analytics. See our Cookie and SDK Notice for detail.

10. Data Retention

We keep personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and maintain accurate records. Retention periods vary by data type:

Account and workspace records are retained while your account is active and for a reasonable period after deletion.
Campaign, payout, ledger, audit, and compliance records may be retained longer for accounting, dispute, tax, fraud, and legal reasons.
Social platform data is retained only while the related connection or submission is active, plus any period required for payout finalization, dispute resolution, fraud prevention, and legal compliance.
Public blockchain data may remain available indefinitely outside LOOT.
Backup copies may persist for a limited period before deletion.

11. Your Choices and Rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about how we process your personal information.

You may also be able to: update account and profile information in the app; disconnect social accounts; delete certain uploaded content; opt out of marketing emails; request account deletion; and ask us to review a moderation or copyright decision.

To exercise rights, contact privacy@getloot.dev. We may need to verify your identity before responding. We will not discriminate against you for exercising privacy rights.

12. Disconnecting Accounts and Data Deletion

You can disconnect a connected social account through available in-app controls or by contacting privacy@getloot.dev. Disconnecting revokes LOOT's access tokens for that account and stops further collection from it, except where retention is required or permitted for the reasons below.

You can request deletion of social platform data we previously collected from a connected account, and deletion of your LOOT account, through available in-app tools or by contacting privacy@getloot.dev. We will delete the data except where retention is required or permitted for payout finalization, legal, safety, fraud, tax, accounting, dispute, copyright, or audit reasons. See our standalone Data Deletion Instructions.

13. United States State Privacy Notice

This section applies to residents of US states with comprehensive privacy laws (including California, Colorado, Connecticut, Texas, Virginia, and others as applicable).

Categories of personal information we may collect: identifiers, contact information, internet or network activity, approximate location, professional or business information, commercial information, financial or wallet-related information, audio/visual content, inferences, and sensitive personal information where provided or required for a feature (such as identity verification for payouts).

We collect and use these categories for the purposes described in this Privacy Policy. We may disclose them to service providers, other users as part of the marketplace, compliance providers, legal advisors, and authorities as described above.

We do not sell personal information for money and do not knowingly sell or share personal information of people under 16. Depending on your state, you may have rights to know, access, correct, delete, obtain a portable copy, limit certain sensitive-data uses, opt out of certain sale/sharing or targeted advertising, and appeal a refusal. To exercise rights or appeal a decision, contact privacy@getloot.dev.

14. EEA, UK, and Similar International Rights

If GDPR, UK GDPR, or similar laws apply, you may have rights to access, correct, delete, restrict, object, port data, withdraw consent, and complain to a supervisory authority. If we transfer personal information internationally, including to the United States, we use appropriate safeguards where required, such as standard contractual clauses or other approved transfer mechanisms.

15. Mexico Privacy Notice and ARCO Rights

If Mexican privacy law applies, you may have ARCO rights: access, rectification, cancellation, and opposition, plus rights to revoke consent and limit certain uses or disclosures. Contact privacy@getloot.dev to submit a request.

16. Other Jurisdictions

LOOT is offered worldwide. Where local law grants additional privacy rights, we will honor them as required. Contact privacy@getloot.dev with jurisdiction-specific requests.

17. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption of social access tokens, segregation of payout and identity data, least-privilege access, and audit logging. No system is perfectly secure. You are responsible for keeping your account, device, email, wallet, recovery methods, and authentication factors secure.

18. Children

LOOT is not intended for children. You must be at least 18 years old, or the age of majority where you live if higher, to use the Services. We do not knowingly collect personal information from children.

19. Changes To This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Services or another reasonable method. The "Last updated" date shows when the policy was last revised.

20. Contact

LOOT Privacy: privacy@getloot.dev Support: support@getloot.dev