Privacy Policy

This policy explains what Lurinth, Inc. ("LootPup", "we") collects when you use the LootPup website, web app and Apple Wallet or Google Wallet pass, why, who we share it with, how long we keep it, and the choices and rights you have. Questions or requests: privacy@lootpup.com (monitored by a person; no account needed).

What we collect, why, and the legal basis

Information you give us

• Sign-in details — when you sign in with Apple or Google we receive your email address (or an Apple private relay address), your name if you share it, and a provider ID. We never see your Apple or Google password. Purpose: account access and recovery, verifying you are a real person before payouts. Legal basis: performance of our contract with you.
• Payout details — the PayPal email, or the email address for Visa prepaid card, Amazon or Roblox gift card delivery, that you enter. Purpose: sending your money. Legal basis: contract.
• Survey profile (optional) — your year of birth, gender and postal code, and your consent to share them, if you choose to unlock surveys. Purpose: matching you with surveys and offers you qualify for, so you are screened out less often. Legal basis: consent, which you can withdraw at any time in Settings (surveys lock again and we delete the answers).
• Phone number (only if we ask you to verify one) — sent to our SMS provider to text you a one-time code. We keep only a one-way hash of the number and its last four digits, to stop one phone being used for several accounts. Purpose: fraud prevention. Legal basis: legitimate interest; contract.
• Consent and preferences — the version of these documents you accepted, when and from which IP address, and whether you opted in to marketing. Legal basis: legal obligation; consent (marketing).
• Support and privacy requests — anything you send us. Legal basis: legitimate interest in responding to you; legal obligation.

Information collected automatically

• Account and activity data — your LootPup account ID, balance and ledger history, offers started and completed, cash out requests and outcomes. Legal basis: contract.
• Device and network data — IP address (and the network it belongs to), approximate country and state or province derived from IP, your phone's language setting, browser and device type, a browser-generated device identifier, device characteristics used to detect emulators and VPNs (time zone, graphics chip, platform, screen size and touch support), and, if you add the Wallet card, an Apple push token or Google Wallet object ID so the card can update. Purpose: security, fraud prevention, duplicate-account detection, keeping your card current. Legal basis: legitimate interest; contract.
• Acquisition source — which campaign or link brought you to LootPup (UTM parameters and referring site). Purpose: measuring which channels bring real users. Legal basis: legitimate interest.
• Offer completion data from Partners — when a network confirms a completion or reverses one it sends us the offer ID, a transaction ID, the amount, and sometimes your IP address at completion. Legal basis: contract.

We do not collect your precise (GPS) location, contacts, photos, or payment card numbers. We do not knowingly collect sensitive categories of information.

Who we share it with

We share personal information only with the parties below, each for the stated purpose. We name every third party individually so you know exactly where your data goes.

Survey and offer networks (our "Partners")

• TheoremReach (Theorem Reach, Inc., United States) — surveys. Receives your LootPup account ID, your IP address, your country, device/browser information, and, if you have given survey consent, your age, gender and postal code, so it can show surveys you qualify for and skip questions you have already answered. It keeps these answers in its own respondent profile and returns completion, disqualification, reversal and quality events to us.
• ayeT-Studios (ayeT-Studios GmbH, Germany) — app and game offers. Receives your LootPup account ID, your IP address, and device information (device make and model, operating system and version, browser user agent and client hints) so it can show offers available in your country that work on your device, and, if you have given survey consent, your age and gender. Returns completion, event and reversal information to us.

We add networks over time; this list is updated in the same release that turns a network on. Each Partner's own privacy policy governs what happens inside their surveys, apps or sites, including any extra questions they ask you directly. When you withdraw survey consent we stop sending your profile answers; to have a Partner delete the profile it holds, contact that Partner or ask us and we will pass the request on. Advertisers whose apps you install receive information through their own apps and attribution tools, under their own privacy policies.

Payout providers

• PayPal, and our reward fulfilment provider Tremendous together with the card and gift-card issuers it uses (Visa prepaid cards, Amazon and Roblox gift cards), receive the destination details needed to send your payment.

Service providers (processors acting on our instructions)

• Cloudflare, Inc. — hosting, database, network security and the Turnstile anti-bot check on sign-up.
• Apple Inc. — Sign in with Apple, Apple Wallet pass delivery and push notifications.
• Google LLC — Sign in with Google, Google Wallet pass delivery and updates.
• Twilio Inc. — sends phone verification codes by SMS, when phone verification is switched on.
• IPQualityScore LLC — assesses whether an IP address is a VPN, proxy, data centre or otherwise high-risk.

Other disclosures

• Legal — if required by law, subpoena, or to protect our rights, users, or the public.
• Business transfers — in a merger, acquisition, or sale of assets, with notice to you.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. Passing your account ID to a Partner so a completion can be credited is a disclosure for a business purpose, not a sale. If you want to record a preference anyway, use Do Not Sell or Share My Personal Information.

Cookies and local storage

The web app stores a session token and a device identifier in your browser's local storage so you stay signed in and so we can recognise duplicate accounts. We do not use third-party advertising cookies. Sign-in providers and the Turnstile check may set their own cookies when you use them.

How long we keep it

• Account, ledger, completion and cash out records — while your account is active and for 7 years afterwards (financial and tax records).
• Consent records — for as long as your account exists plus 7 years, so we can show what you agreed to.
• Raw Partner callbacks — 90 days (matching the window in which Partners may reverse a completion), then deleted.
• Sign-in, IP and device signals used for fraud prevention — 24 months.
• Support and privacy requests — 3 years.

When you close your account we delete or de-identify personal data that we are not required to keep for the periods above.

Your rights and how to use them

Depending on where you live you may have the right to: access the personal information we hold about you; correct it (rectification); delete it (erasure); receive a portable copy; object to or restrict certain processing; withdraw consent where processing is based on consent; and, in California, to opt out of sale or sharing and to not be discriminated against for exercising your rights.

Make any of these requests through the privacy request form or by emailing privacy@lootpup.com. You don't need an account or a login. We confirm receipt, may ask you to verify that you own the email address on the account, and respond within 30 days (45 days for California requests, as the law allows). You may designate an authorised agent to act for you. If you are in the EU/EEA or UK you also have the right to lodge a complaint with your data protection authority.

Everyday controls: turn marketing email on or off any time in Account or via the unsubscribe link in each email; remove the Wallet card from your phone at any time to stop push updates to that device.

Children

LootPup is for adults 18 and over. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

Security

Data is encrypted in transit, sign-in is handled by Apple and Google rather than passwords, secrets are held in a managed vault, and access to production systems is restricted and logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

International transfers

We are based in the United States and process data there. If you use the Service from elsewhere your information is transferred to the US. ayeT-Studios is based in Germany, so the information listed above for it is transferred to and processed in the European Union, where it is protected under the EU General Data Protection Regulation.

Changes

Each change to this policy mints a new version with a new date. Material changes are flagged in the app and, where consent is required, you will be asked to accept the new version.

Contact

Lurinth, Inc. · Privacy: privacy@lootpup.com · Support: support@lootpup.com