Privacy Policy

The controller is [LEGAL ENTITY NAME] of [REGISTERED ADDRESS]. For anything in this policy, contact [PRIVACY CONTACT EMAIL].

• Account details — your email address, a username if you choose one, and your country.
• Delivery details — the name, address, phone number and any sizing you give us when you ask for an item to be shipped.
• Activity — every box you open, the outcome, and the fairness record that proves it. This is retained permanently: it is the evidence that a result was not tampered with.
• Money movements — a double-entry record of every change to your balance, and, once deposits and withdrawals are enabled, the payment and verification records the law requires us to keep.
• Support — the messages and attachments you send us, and our replies.
• Technical — your IP address and approximate country at the moment you open a box, used for fraud checks and to apply territorial restrictions.

• To run your account and let you open boxes, order items and get support — this is necessary to perform our contract with you.
• To keep the game provably fair and to detect fraud and abuse — our legitimate interest in a service that cannot be cheated.
• To meet legal and accounting obligations.
• To send you marketing, where you have opted in. You can withdraw that at any time.

• We do not sell your data.
• We do not run advertising networks or third-party trackers on the site.
• We do not profile you to change your odds. Published odds are the same for every account.

Only the suppliers needed to run the service: our hosting and database providers, our email provider, the couriers and retailers used to fulfil an item you have asked us to ship, and — once deposits and withdrawals are enabled — our payment and identity-verification providers. Each receives only what that job requires.

We may disclose data where the law requires it, or to establish or defend a legal claim.

Account and delivery records are kept for as long as your account is open, and afterwards for as long as we are required to keep them.

Fairness records and credit movements are permanent and cannot be edited or deleted, including by us. They are the integrity record of the platform. Where you exercise a right to erasure, these are disassociated from your identity rather than destroyed.

Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable form, and withdraw consent to marketing.

Ask us through support or at [PRIVACY CONTACT EMAIL]. You also have the right to complain to [SUPERVISORY AUTHORITY].

Access to your data is enforced by the database itself rather than by application code, so a query can only ever return your own records. Administrative access is restricted, requires two-factor authentication, and every administrative action is logged.

Lootra is strictly for adults aged 18 or over. We do not knowingly collect data from anyone under 18, and will delete it if we discover we have.

Covered separately in our cookie policy.