Privacy Policy

1. Who we are

LootLab (lootlab.lol) is run by LootLab, based in the United Kingdom. We decide how your information is used, which makes us its "controller" under UK data protection law. Contact us about anything on this page at alfieway67@gmail.com.

2. What we collect

• Your account: email address, username, password (stored only as a scrambled hash that we can't read) and when you joined.
• Your Roblox username, so sellers know where to send what you buy.
• Your listings: item names, descriptions, prices and photos. Photos are resized when you upload them, and hidden details such as a phone's GPS location are removed.
• Orders and payments: what you bought or sold, prices, fees, order status and timings. Card and bank payments are handled by Stripe, so we never see your full card number. We keep Stripe's reference numbers for each payment and refund.
• Order chats: messages and photos sent between the buyer, the seller and LootLab support, and your auto-reply message if you set one.
• Payouts: for bank withdrawals, the account holder's name, sort code and account number. The full account number is encrypted, and it's wiped from the payout as soon as the payout is sent or turned down. If you choose to save your bank details for next time, they're kept encrypted until you ask us to remove them or close your account. For Robux payouts, the gamepass you give us.
• Crypto deposits: the coin, the amount, the wallet address it came from and the transaction. These are public on the Base blockchain anyway.
• LootLab Pro: the Stripe customer and subscription references for your membership.
• Notifications we show you on the site, and emails we send you.
• Technical information: a cookie that keeps you logged in, and short-term logs kept by our hosting provider (such as your IP address, browser type and the pages you asked for) for security and fixing problems. Your IP address is also used briefly to stop spam and to count listing views. That happens in memory and isn't saved.
• In your own browser (not sent to us until you use it): your cart, the Roblox username you last checked out with, and whether you've turned sounds on.

3. Why we use it

• To run LootLab for you: your account, orders, payments, refunds, payouts, chats and notifications. The law calls this "performing our contract" with you.
• To keep LootLab safe and fair: stopping fraud, scams and chargeback abuse, sorting out disputes and enforcing our Terms. This is in our and our users' "legitimate interests".
• To follow the law: keeping financial records and answering lawful requests from authorities.
• To message you about your account and orders, like sales, deliveries and payouts. We don't send marketing emails.

4. Who we share it with

• The other person in your order: your username, your Roblox username, the order details and your chat messages.
• Stripe: card and bank payments, refunds, chargebacks and fraud checks. Stripe also uses some of this information under its own privacy policy.
• Railway: hosts our website and database, on servers in the United States.
• Discord: alerts for LootLab staff about orders and payouts go to a private Discord channel, and can include usernames, Roblox usernames and order details.
• Blockchain data providers (such as Alchemy): we ask them about payments to our own wallet address. Crypto transactions are public.
• Google Fonts: the site's fonts load from Google, so Google sees your IP address.
• Authorities, when the law requires it, or to protect someone from fraud or harm.

We don't sell your data, and we don't send it to Roblox.

Some of these companies store data outside the UK, mostly in the United States. When they do, they use the safeguards that UK law requires, such as the UK–US data bridge or approved contract terms.

5. How long we keep it

• Your account: while it's open. When you close it, we delete or anonymise your details, apart from the records below.
• Orders, payments, payouts and their chats: up to 6 years after the order, for accounting and tax, and in case of disputes or chargebacks.
• Full bank account numbers on payouts: wiped once the payout is sent or turned down.
• Hosting logs: kept by our hosting provider for a short time.

6. Your rights

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that's wrong;
• delete your information (we'll keep only what the law makes us keep);
• stop or limit how we use it, or send it to you in a format you can take elsewhere.

Email alfieway67@gmail.com from the address on your account. We'll reply within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Children

LootLab is for people aged 13 and over. If you're under 13, please don't use it. If we find out that someone under 13 has an account, we'll close it and delete their information, apart from payment records we have to keep. If you're between 13 and 17, it's a good idea to talk to a parent or guardian before you buy or sell.

8. Keeping it safe

The site only works over a secure (HTTPS) connection. Passwords are hashed, bank account numbers are encrypted, and only LootLab staff can see payout details. No system is perfect. If something goes wrong that puts your information at risk, we'll tell you, and the ICO where the law says we must.

9. Cookies

We use one cookie, ll_session, which keeps you logged in for up to 30 days. It's needed for the site to work, so it doesn't need your consent. Your cart, Roblox username and sound setting are saved in your own browser's storage. We don't use advertising, analytics or tracking cookies.

10. Changes

We'll update this page if what we collect or how we use it changes. The date at the top shows the latest version. If a change matters, we'll tell you on the site.