This Privacy Policy explains how TokenLooT, the operator of TokenLooT and of the website at https://tokenloot.shop, collects, uses, shares and protects personal information when you use our website, our Telegram bot and our customer dashboard (together, the "Service"). We have written it to be readable rather than legalistic, and it is intended to meet our obligations under the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and comparable privacy laws. If you have any question after reading it, contact us at admin@tokenloot.shop.
1. Information we collect
Account information. When you register we collect the identifiers you choose to sign up with: your Telegram user ID, username and display name if you use the bot; your email address and a hashed password if you register with email; or the email address and basic profile information supplied by a single sign-on provider such as Google if you sign in that way. We never store your password in readable form.
Transaction information. We record the orders you place, the products and quantities involved, the amounts charged, your store balance movements, coupon and referral usage, invoice identifiers from our payment processors and, for cryptocurrency payments, the public payment address and transaction reference. We do not receive or store full card numbers.
Support information. If you open a ticket or message the bot, we keep the content of that conversation, any attachments you send and the metadata needed to answer you.
Technical and log information. Our servers automatically log your IP address, approximate location derived from it, browser and device type, operating system, referring page, pages viewed, timestamps and error traces. We also record security events such as login attempts, failed logins, captcha results and rate-limit hits.
Cookies and similar technologies. See section 5.
We do not deliberately collect special categories of data (such as health, biometric, political or religious information) and ask that you do not send such information to us.
2. How we use your information
- to create and administer your account and authenticate you;
- to process payments, credit your balance, deliver purchased digital goods and keep an order history you can consult;
- to provide customer support and handle refund or warranty requests;
- to send transactional messages such as order confirmations, delivery notices, deposit confirmations, password resets and email verification codes;
- to detect, investigate and prevent fraud, abuse of promotions, chargeback fraud, account takeover and other security incidents;
- to operate, measure and improve the Service, including aggregate analytics about which products and pages are popular;
- to send optional marketing and product-update messages where you have opted in or where permitted by law, always with a way to opt out;
- to comply with legal obligations, including accounting, tax and anti-money-laundering requirements, and to enforce our Terms of Service.
3. Legal bases for processing (GDPR)
Where the GDPR applies, we rely on the following legal bases. Contract performance for creating your account, taking payment and delivering the products you ordered. Legitimate interests for security, fraud prevention, service improvement and defending legal claims — balanced against your rights and interests. Consent for non-essential cookies, advertising and analytics technologies and for optional marketing messages; consent can be withdrawn at any time. Legal obligation for record-keeping, tax and regulatory reporting.
4. Sharing your information
We do not sell your personal information for money. We share it only with:
- payment processors, including cryptocurrency payment gateways, who receive the data needed to create and settle an invoice;
- infrastructure providers such as our hosting, storage, content-delivery, backup and monitoring vendors;
- communication providers such as our transactional email sender and the Telegram platform, which necessarily processes messages exchanged with our bot under its own privacy policy;
- advertising and analytics partners as described in section 5;
- product vendors where a purchase must be provisioned on a third-party platform, limited to the identifier required to fulfil it;
- professional advisers, auditors, and authorities where we are legally required to disclose information, or where disclosure is necessary to establish, exercise or defend legal claims;
- a successor entity in the event of a merger, acquisition, financing or sale of assets, subject to this Policy continuing to apply.
Under the CCPA/CPRA, sharing personal information with advertising partners through cookies may be treated as a "sale" or as "sharing" for cross-context behavioural advertising. Residents of California and other US states with similar laws may opt out as described in sections 5 and 8.
5. Cookies, analytics and advertising
We use cookies and similar technologies (local storage, pixels, SDK identifiers) for three purposes. Strictly necessary cookies keep you signed in, remember your cart and protect forms against cross-site request forgery; the Service cannot work without them. Analytics cookies help us understand aggregate traffic and improve pages. Advertising cookies may be set by third-party ad networks to measure campaigns and to show more relevant advertisements.
Where advertising is enabled on our pages, third-party vendors — including Google — may use cookies to serve ads based on your prior visits to our website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and other sites on the internet. You can opt out of personalised advertising by Google at google.com/settings/ads, opt out of third-party vendor cookies at optout.aboutads.info and youronlinechoices.eu, and read Google's advertising practices at policies.google.com/technologies/ads. Where we use Google Analytics you can install Google's opt-out browser add-on from tools.google.com/dlpage/gaoptout.
You can also block or delete cookies in your browser settings and enable "Do Not Track" or global privacy control signals; blocking strictly necessary cookies will prevent you from signing in.
6. International transfers
We and our providers operate internationally, so your information may be processed in countries other than your own, including countries that are not recognised as providing an equivalent level of data protection. Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, together with technical measures such as encryption in transit.
7. Retention and security
We keep personal information only as long as we need it. Account and order records are retained while your account is active and afterwards for as long as required for accounting, tax, warranty and fraud-prevention purposes — typically up to seven years for financial records. Support conversations are normally kept for up to twenty-four months. Technical logs are kept for a short period, generally up to twelve months, and security event logs may be kept longer where needed to investigate abuse. After the applicable period we delete or irreversibly anonymise the data.
We protect your information with encryption in transit, hashed passwords, access controls limited to staff who need the data, API authentication, rate limiting, captcha protection and regular backups. No system is perfectly secure; if a breach affects your personal data and creates a risk to you, we will notify you and the relevant supervisory authority as required by law.
8. Your rights
Subject to local law, you may ask us to: confirm whether we hold personal information about you and give you a copy of it; correct inaccurate or incomplete data; delete data we no longer need; restrict or object to certain processing, including profiling for fraud scoring; port your data to another provider in a machine-readable format; and withdraw consent you previously gave. California residents may additionally request disclosure of the categories of personal information collected, used, disclosed or shared in the preceding twelve months, may opt out of the "sale" or "sharing" of personal information, may request correction or deletion, and may not be discriminated against for exercising these rights. You may use an authorised agent to submit a request on your behalf.
To exercise any right, write to admin@tokenloot.shop from the address associated with your account, or open a ticket from your dashboard. We will respond within the period the law allows — one month under the GDPR and forty-five days under the CCPA, each extendable where permitted — and we may need to verify your identity first. If you are unhappy with our response, you may complain to your local data protection authority.
9. Children's privacy
The Service is intended for people aged 18 and over. We do not knowingly collect personal information from children under 18 (or under 16 where local law sets that threshold for online services). If you believe a child has provided us with personal information, contact admin@tokenloot.shop and we will delete the account and its data promptly.
10. Automated decision-making
We use automated checks to score orders and deposits for fraud risk, which may delay an order for manual review or block a transaction. These checks do not produce legal effects beyond the affected transaction, and you can always ask a human to review the outcome by contacting admin@tokenloot.shop.
11. Changes to this Policy
We may update this Policy to reflect changes in our practices, our providers or the law. We will update the "Last updated" date above and, where the change is material, give notice through the Service. Please review the page from time to time.
12. Contact us
For any privacy question or request, contact TokenLooT at admin@tokenloot.shop, or open a support ticket at https://tokenloot.shop. If we are required to appoint a data protection representative or officer in your region, their details will be provided on request.