Version of 16 October 2026, in force from 1 November 2026. This Policy explains how Lootera processes personal data. It is written to meet the EU General Data Protection Regulation (GDPR), Brazil's LGPD (Law 13.709/2018), the California Consumer Privacy Act (CCPA/CPRA) and the data protection laws of the other countries where Lootera is played. Capitalised terms have the meaning given in the Terms of Use.

In short: we process only the data needed for the game to work and stay secure. We do not sell or rent personal data, do not share it for advertising, and use no advertising or tracking tools.

1. Controller and contact

The controller is the Lootera team, based in Brazil (Terms of Use, clause 1); once Lootera is run through a company, that company will be the controller, named here with its legal name and CNPJ. For privacy questions and to exercise your rights: support@lootera.net or the support channel of the official Lootera Discord. Brazilian users may treat this address as the contact of our data protection officer (encarregado) under the LGPD.

2. Data we process

(a) Account and sign-in data: Account identifier, e-mail address and the identifier given by the sign-in provider you choose (Google, Discord or e-mail); (b) Game data: Character names, progress, items, Lootera Coins, chat messages, bids and auctions; (c) Technical and security data: IP address, date and time of access, browser type, error logs and the results of the anti-bot check; (d) Crypto contribution data: the public address of the sending wallet, amount, network and transaction identifier; (e) Pix contribution data: the details a Pix charge requires (such as name, CPF and e-mail or phone), passed to the payment provider for that charge and not kept on our servers, and the record of the order we keep (amount, status, bonus Coins credited and the provider's transaction identifier); (f) Acceptance records: the Account, the moment and the IP address of each acceptance of the Terms of Use. We never receive private keys, recovery phrases or card data.

3. Why we use it, and on what legal basis

(a) To create and run your Account and provide the Service: performance of the contract (GDPR art. 6(1)(b); LGPD art. 7, V). (b) To process contributions, bonus Coins, bids and auctions: performance of the contract. (c) To prevent fraud, abuse, bots and attacks, and to apply the limit of Accounts per IP and the block on VPNs and proxies: our legitimate interest in a secure and fair game (GDPR art. 6(1)(f); LGPD art. 7, IX and art. 11, II, g). (d) To keep contribution and access records as the law requires: legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II; Brazil's Marco Civil da Internet, art. 15). (e) To answer support requests: performance of the contract and legitimate interest.

We do not profile you for advertising or use your data for marketing. The only automated decisions are the anti-fraud and anti-bot checks (for example, refusing a connection from a VPN); you can ask a person to review any such decision through support.

4. Who we share it with

Only with providers the Service needs, who process data on our behalf or as independent controllers of their own services: the sign-in providers (Google, Discord), the e-mail provider that sends the sign-in codes (Resend), Cloudflare (network, DNS, protection and the Turnstile anti-bot check), our server hosting provider, the payment provider of Pix contributions (named on the contribution page), and the price services we ask for the price of SOL (they receive no personal data). Crypto transfers are recorded on public blockchains, where transactions are public and permanent by nature. We may also disclose data when required by law or by a court order.

5. International transfers

Our servers are in the United States, and some providers process data outside your country. Transfers from the EU and the UK rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Transfers from Brazil rely on the mechanisms of LGPD art. 33. You can ask us for a copy of the safeguards used.

6. How long we keep it

Account and game data: while your Account exists. Access logs (IP, date and time): 6 months. Contribution and acceptance records: as long as the law requires and for the defence of legal claims. After that, data is deleted or anonymised.

7. Security

We use reasonable technical and organisational measures, such as encrypted connections (HTTPS), restricted server access and anti-bot protection. No system is fully immune to incidents. If a breach is likely to put your rights at risk, we will notify the competent authorities within the deadlines of the applicable law (72 hours under the GDPR) and, where required, you.

8. Your rights

Everyone: you can ask to access, correct, delete or receive a copy of your data, object to or restrict its processing, and close your Account. Deleting the Account removes its Characters and Virtual Content, without refund. We answer within one month (15 days for requests under the LGPD).

EU and UK: you may also complain to a data protection authority, in particular the one where you live. Brazil: you have the rights of LGPD art. 18 and may complain to the Autoridade Nacional de Proteção de Dados (ANPD). California and other US states with privacy laws: you have the right to know, delete and correct your personal information and not to be discriminated against for using these rights; we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.

9. Children

The Service is not meant for children under 13. Players under the age of digital consent in their country (in the EU, between 13 and 16 depending on the country) or under 18 may only use it with the consent of a parent or guardian. If we learn that we hold data of a child without that consent, we delete it.

10. Cookies

We use only strictly necessary storage, described in the Cookie Policy.

11. Changes

This Policy may change. The current version is always on this page, with its date; material changes are announced on our official channels.