Privacy Policy

LOOTZ (“we”, “our”, or “us”) operates this e-commerce website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase. Please read it carefully. By using LOOTZ, you consent to the practices described here.

For any questions, contact us at lootz.store.official@gmail.com.

2.1 Account Information

When you sign in using Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive your Google password.

2.2 Order Information

When you place an order, we collect:

• Full name and email address
• Phone number (10-digit Indian mobile)
• Shipping address (including city, state, pincode)
• Order details (products, quantities, amounts)
• Payment method (Razorpay / Cash on Delivery)

2.3 Payment Information

For online payments, transactions are processed by Razorpay. We store only the Razorpay order ID, payment ID, and signature for verification purposes. We do not store your card number, CVV, UPI ID, or any other sensitive payment credentials.

2.4 Technical Information

We may automatically collect standard log data including your IP address, browser type, pages visited, and the date and time of your visit. This is used for security, debugging, and analytics purposes.

We use the information we collect to:

• Process and fulfil your orders
• Send order confirmations and shipping updates
• Respond to your enquiries and support requests
• Authenticate your account and maintain session security
• Improve our website and product offerings
• Comply with applicable legal obligations

We do not sell your personal information to third parties, and we do not use it for advertising profiling.

We use the following third-party services that may process your data:

4.1 Google OAuth (Authentication)

Sign-in is handled by Google. By logging in with Google, you agree to Google’s Privacy Policy. We receive only your name, email, and profile picture.

4.2 Razorpay (Payment Processing)

Online payments are processed by Razorpay, a PCI-DSS compliant payment gateway. Your payment details are entered directly on Razorpay’s secured interface and are governed by Razorpay’s Privacy Policy.

4.3 Contabo Object Storage (Media Storage)

Product images and media files are stored on Contabo Object Storage (S3-compatible), hosted in Singapore. Only product images are stored there — your personal data is not.

4.4 MongoDB Atlas (Database)

Your account, order, and address data is stored in a MongoDB Atlas database hosted on secure, encrypted cloud infrastructure.

We use the following cookies:

• Authentication session cookie — set when you sign in with Google via Auth.js. This is an HTTP-only, secure cookie used to keep you logged in.
• Admin session cookie — set when an admin logs into the admin panel. HTTP-only and session-scoped.

We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. You can clear cookies from your browser settings at any time; this will log you out of your account.

We retain your account information for as long as your account is active. Order records are retained for a minimum of 7 years for legal and accounting compliance.

If you request account deletion, we will remove your personal information from our active systems within 30 days, subject to any legal retention obligations.

We implement commercially reasonable technical and organisational measures to protect your data, including HTTPS encryption in transit, HTTP-only session cookies, hashed credentials, and access controls on our database and storage.

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and personal data
• Withdraw consent where processing is consent-based

To exercise any of these rights, email us at lootz.store.official@gmail.com. We will respond within 15 business days.

LOOTZ is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Continued use of the website after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests, please contact: