Legal
LootHQ Privacy Policy
Version 1.0 — Effective 4 August 2026 · Last updated 4 August 2026
LootHQ Inc. ("LootHQ", "we", "us") operates an advertising platform that connects advertisers with publishers who display our offerwall. This policy explains what personal information we collect, why, who we share it with, and what rights you have.
Controller. LootHQ Inc., a corporation incorporated under the Canada Business Corporations Act. Contact: privacy@loothq.net.
This policy covers three groups: end users of the offerwall, publishers who integrate it, and advertisers who run campaigns. Where a section applies to only one group, it says so.
1. Our role, and the publisher's role
Most people who encounter LootHQ do so through a publisher's website or app. That publisher holds your account, knows your identity, and decides what your rewards are worth. We do not hold your account and, in the ordinary course, we do not know your name or email address.
We identify you by a pseudonymous sub-identifier that the publisher generates and passes to us. We use it to attribute your offer completions and to enforce per-user limits. We ask publishers not to pass names, email addresses, government identifiers, or payment data in that field, and our terms prohibit it.
For end-user data processed through the offerwall, LootHQ and the publisher each act as independent controllers — each decides its own purposes and means. The publisher's own privacy policy governs your account with them.
2. Information we collect
2.1 End users of the offerwall
We collect this automatically when you interact with the offerwall:
| Category | Examples |
|---|---|
| Pseudonymous identifiers | Publisher-supplied sub-identifier, our internal click identifier, obfuscated publisher and placement identifiers |
| Device and connection | IP address, user agent, browser, operating system, device type, language |
| Location (approximate) | Country, and in some cases region, derived from IP address — we do not collect GPS or precise location |
| Activity | Offers viewed and clicked, timestamps, conversions and their status, coin credits, reward credits, reversals |
| Fraud signals | Request patterns, velocity, IP reuse, device characteristics, proxy/VPN indicators |
| Support correspondence | Anything you send us at support@loothq.net, including screenshots you choose to attach |
We do not ask you to create a LootHQ account to use the offerwall, and we do not collect your name, email address, postal address, or payment information as part of offerwall use.
Information you give advertisers. When you click an offer, you leave the offerwall and interact with the advertiser. Anything you provide to them — account details, email, payment information — is collected by them under their privacy policy, not ours. We receive only the fact of a completion and the parameters described in Section 4.
2.2 Publishers and advertisers (account holders)
For business account holders we collect: name, business name, email address, account credentials (stored hashed), two-factor authentication data, payout or billing details, tax information where required, communications with us, and audit records of actions taken in the dashboard.
2.3 Our own website
loothq.net does not currently run any analytics product, and we set no advertising or analytics cookies on it. Our hosting provider (Vercel) generates standard server logs — including IP address and user agent — which we use only to operate, debug, and secure the service.
3. Why we use it, and our legal basis
| Purpose | Basis (GDPR/UK GDPR) |
|---|---|
| Delivering offers, recording clicks, and attributing conversions | Legitimate interests; contract (for account holders) |
| Crediting, holding, and reversing rewards | Legitimate interests |
| Fraud detection and prevention, enforcing caps and limits | Legitimate interests; legal obligation |
| Billing advertisers and paying publishers | Contract; legal obligation |
| Aggregate reporting and analytics | Legitimate interests |
| Support and dispute resolution | Legitimate interests; contract |
| Security, logging, and incident response | Legitimate interests; legal obligation |
| Legal compliance, tax, and record-keeping | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest in operating a functional, fraud-resistant advertising platform is not overridden by your rights, in part because the data we hold about offerwall users is pseudonymous and limited to what attribution and fraud prevention require.
We do not sell personal information for money. See Section 6 for how US state privacy laws treat the sharing described below, and the choices available to you.
4. Who we share it with
4.1 Advertisers
To attribute your completion so that you get rewarded, we pass data to the advertiser or their tracking provider at the time you click an offer. Depending on the advertiser's configuration this may include: our click identifier, an obfuscated publisher identifier, a hashed user identifier, country, device type, operating system, browser, IP address, and user agent.
In addition, clicking an offer redirects your browser to the advertiser's own site, so your browser connects to their servers directly — which necessarily reveals your IP address and browser characteristics to them, exactly as visiting any website does.
Advertisers act as independent controllers of data we send them and use it for attribution, fraud prevention, and their own analytics under their own privacy policies.
4.2 Publishers
We send publishers conversion and reversal notifications containing their own sub-identifier, the offer, the amount, and the transaction identifier. Publishers see aggregate performance data and activity logs for their own traffic, including IP addresses associated with their own users' clicks.
4.3 Service providers
We use the following processors and service providers:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and edge network | United States |
| MongoDB Inc. (Atlas) | Primary database | United States |
| Stripe, Inc. | Advertiser payment processing | United States |
| Zoho Corporation | Business email | Global (per Zoho's data-centre disclosure) |
| Resend, Inc. | Transactional email delivery | United States |
| PayPal, Inc. / Wise Payments Ltd | Publisher payouts (per the publisher's selected method) | United States / United Kingdom |
We may add or change providers; this table will be updated. Providers act on our instructions under written agreements.
4.4 Other disclosures
We may disclose information where required by law, subpoena, or court order; to investigate suspected fraud or protect our rights, users, or the public; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this policy.
5. International transfers
We are based in Canada and our infrastructure is hosted in the United States. Advertisers, publishers, and service providers may be located anywhere in the world. This means personal information may be transferred to, stored in, and processed in countries whose data protection laws differ from those in your country.
Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or Swiss equivalent as applicable), together with supplementary measures where required. Transfers from Canada are made in accordance with PIPEDA, under which we remain accountable for information transferred to third parties for processing. You can request further information about our transfer mechanisms at privacy@loothq.net.
6. Your rights and choices
6.1 Everyone
You may contact privacy@loothq.net to request access to, correction of, or deletion of your personal information, to object to or restrict processing, or to request a copy in portable form. We will respond within the time required by applicable law.
A practical note for offerwall users: because we identify you only by a publisher-supplied pseudonymous identifier, we usually cannot find your records from your name or email alone. To help us locate your data, tell us which site you used, the sub-identifier if you can obtain it from that site, and the approximate dates. If we cannot re-identify you, we may not be able to fulfil the request — and we will not collect additional identifying information from you solely to do so. In most cases the fastest route is to contact the publisher, who holds your account.
6.2 EEA, UK, and Switzerland
You have the rights of access, rectification, erasure, restriction, portability, and objection, including the right to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time. You have the right to lodge a complaint with your local supervisory authority.
6.3 California and other US states
We do not sell personal information for monetary consideration. However, the transmission of identifiers and device data to advertisers described in Section 4.1 may constitute a "sale" or "sharing" under the CCPA/CPRA and comparable state laws.
Do Not Sell or Share My Personal Information: to opt out of that transmission in respect of your future offerwall activity, email privacy@loothq.net with the site you use and your sub-identifier (see Section 6.1 for how to find it), or stop using the offerwall — no data is transmitted to advertisers except when you click an offer.
California residents also have the right to know, delete, correct, and not be discriminated against for exercising these rights. Requests: privacy@loothq.net.
6.4 Canada
Under PIPEDA you may access and correct your personal information and complain to the Office of the Privacy Commissioner of Canada.
7. How long we keep it
| Data | Retention |
|---|---|
| Click and conversion records, postback receipts, coin ledger entries | 24 months from creation |
| IP addresses and user agent strings on click and conversion records | 90 days, after which the fields are deleted from the records |
| Aggregate and statistical data (no identifiers) | Indefinitely |
| Publisher and advertiser account records, invoices, payout records | 7 years after account closure, for tax and audit purposes |
| Fraud investigation records | Up to 24 months, or longer where an investigation or legal claim is ongoing |
| Support correspondence | 24 months |
We keep conversion records for 24 months because advertiser disputes, chargebacks, and payment reconciliation can arise long after a conversion, and because we must be able to demonstrate why a reward was granted or reversed.
8. Cookies and similar technologies
The offerwall uses only the storage strictly necessary to operate: maintaining your session within the wall and preventing duplicate or fraudulent completions. We do not use third-party advertising cookies or cross-site tracking pixels in the offerwall.
When you click an offer, you are redirected to the advertiser, who may set their own cookies and identifiers under their own policy.
On loothq.net we set no analytics or advertising cookies (Section 2.3); the only cookies are those strictly necessary for signed-in dashboard sessions and security.
9. Security
We protect data using encryption in transit (TLS), access controls and role separation, mandatory two-factor authentication for administrative accounts, hashed credentials, token-based authentication for API and postback access with optional request signing and IP allowlisting, audit logging of administrative actions, and an append-only financial ledger.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulators where required by law.
10. Children
The offerwall is intended for people 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and our publisher agreements require publishers to ensure their audiences meet this requirement and not to integrate our offerwall into services directed to children.
If we learn that we hold information about a person under 18, we will delete it and cancel any associated rewards. If you believe a minor has used the offerwall, contact privacy@loothq.net and we will act promptly.
11. Changes to this policy
We may update this policy. We will post the updated version with a new "last updated" date, and where changes are material we will notify account holders by email or dashboard notice. Continued use after the effective date constitutes acceptance.
12. Contact
LootHQ Inc.
Privacy enquiries and rights requests: privacy@loothq.net
General support: support@loothq.net
Legal: legal@loothq.net