Privacy Policy
Last updated: 17 October 2026 · Version française
The data controller is LLoot, operator of LLoot. Contact for any privacy question: [email protected].
1. Data we collect
- Account: email address, username, password (stored encrypted by our authentication provider, never readable by us).
- Marketplace activity: offers, orders, order chat messages, reviews, disputes, support messages.
- Payments and payouts: payment network, transaction hashes, the wallet addresses you send from or ask us to pay to, balances.
- Identity information, only if a check is required (large withdrawals, fraud, tax reporting).
- Technical data: IP address and browser information processed by our hosting provider for security and delivery of the site.
- On your device: your session and preferences (currency, language) in your browser's local storage. We use no advertising or tracking cookies and no analytics tools.
2. Why we use it (and legal basis)
- To run your account and the marketplace, process orders, payments, payouts and disputes: performance of the contract.
- To prevent fraud and secure the platform: legitimate interest.
- To keep accounting records, and report sellers to tax authorities when required (DAC7): legal obligation.
- To send account emails (confirmation, password reset) and answer your messages: performance of the contract.
3. Who receives it
- Other users see your username, offers, ratings and reviews; your trading partner sees the order chat. Your email is never shown.
- Service providers acting on our instructions: Supabase (database, authentication, file storage), Cloudflare (hosting, security, email forwarding), Google (sending of account emails, and the Google Fonts typeface loaded by your browser).
- Authorities, when the law requires it.
Some providers are located outside the European Union, notably in the United States. Transfers rely on the safeguards provided by the GDPR (European Commission adequacy decision for certified companies, or standard contractual clauses).
Blockchain: crypto transactions are public and permanent on the Polygon network. We cannot delete them.
4. How long we keep it
- Account data: as long as your account exists, then deleted, except what must be kept below.
- Orders, payments, payouts and accounting records: 10 years (legal accounting obligation).
- Order chat and dispute messages: 3 years after the order closes, for evidence in case of claims.
- Support messages: 3 years after the last message.
- Identity information: as long as legally required after the end of the relationship.
5. Your rights
You can ask to access, correct or delete your data, to receive it in a portable format, to object to or restrict its use, and give instructions about what happens to it after your death. Write to [email protected]; we answer within one month. You can also lodge a complaint with your data protection authority (in France: the CNIL, cnil.fr).
6. Security
Access to data is restricted by database rules, connections are encrypted (HTTPS), and money movements are recorded in an audit ledger. No system is perfectly secure: use a unique password and tell us immediately if you suspect misuse of your account.