PRIVACY POLICY

Loot Studios (Kraken Produtos Digitais Ltda.)

Effective date: June 2026

Loot Studios is operated by Kraken Produtos Digitais Ltda., a company incorporated under the laws of Brazil with registered offices in Belo Horizonte, State of Minas Gerais (“Loot Studios,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, store, transfer, and protect personal data when you use our website, subscribe to our services, or interact with our digital-content platform.

By using our Site or Services, you acknowledge that you have read and understood this Policy. If you do not agree, please stop using the Site.

1. Scope

This Privacy Policy applies to the processing of personal data in connection with the operation of lootstudios.com (the “Site”) and the digital content subscription services offered by Loot Studios.

It covers personal data collected from Site visitors, registered users, subscribers to any Loot Studios subscription plan, including Free, Single Loot, Double Loot, and any future plans that may be made available, as well as individuals who contact our support team or participate in promotions, community activities, or other features and services provided by Loot Studios.

This Privacy Policy does not apply to third-party websites, platforms, or services that may be accessible through links available on the Site.

For the purposes of applicable data protection laws, the data controller responsible for the processing of personal data described in this Privacy Policy is Kraken Produtos Digitais Ltda., a company headquartered in Belo Horizonte, State of Minas Gerais, Brazil. Questions, requests, or concerns regarding privacy and data protection may be directed to privacy@lootstudios.com.

2. Data We Collect

We collect data you provide directly, data generated by your use of the Site, and data received from our service providers.

Account and subscription data

When you create an account or subscribe to a plan, we collect information such as your full name, email address, username, account password (stored in a secure hashed format and never in plain text), subscription plan details, billing address, subscription start and renewal dates, and records relating to plan changes, upgrades, downgrades, and cancellations.

Payment data

We do not store your full card number, CVV, or banking credentials. Payment transactions are processed by our third-party payment partners. We retain only the payment method type, the last four digits of your card where provided by the processor, the billing address, transaction reference numbers, and payment status.

Subscription activity

We maintain records of the bundles and digital content you redeem or download, your bundle selection history across Fantasy and Sci-Fi categories, automatic redemption events under your Single Loot or Double Loot plan, your Loot Rewards balance and Loot Coins transaction history, and refund, chargeback, and dispute records where applicable.

Device and usage data

When you access the Site, we automatically collect your device type, operating system, browser type and version, language settings, pages visited, time spent, navigation paths, links clicked, download events, and session information. We also collect your IP address, access timestamps, server logs, and referrer URLs. IP addresses are treated as personal data to the extent they can identify an individual.

Cookies and analytics

We use cookies, tracking pixels, and similar technologies to operate the Site, personalize the user experience, understand platform usage, and improve our services.

Data collected through these technologies is processed, whenever possible, in aggregated or pseudonymized form and used in accordance with the purposes described in this Policy.

Support and communications

When you contact our support team, we collect your name, email address, the content of your inquiry, any attachments you provide, and relevant account information. Where you have subscribed to marketing communications, we also process your communication preferences, email engagement records, and unsubscribe requests.

You may unsubscribe from marketing emails at any time using the link in any email we send or by contacting privacy@lootstudios.com.

3. How and Why We Use Your Data

We use your data for the following purposes, each grounded in an appropriate legal basis:

• Delivering our services: processing your subscription, managing your account, delivering digital content, administering bundle selections and automatic redemptions under your plan, and operating the Loot Rewards and Loot Coins programme. Legal basis: contract performance.
• Billing and payments: processing charges, issuing receipts, managing renewals, and handling refunds, chargebacks, and disputes. Legal basis: contract performance.
• Customer support: responding to inquiries, resolving issues, and maintaining support records. Legal basis: contract performance and legitimate interest.
• Communications: sending transactional messages (receipts, renewal reminders, account notifications) and, where you have consented or where permitted by law, marketing communications. Legal basis: contract performance and consent.
• Security and fraud prevention: detecting and preventing fraud, unauthorised access, piracy, and the unauthorised commercial use of digital content. Legal basis: legitimate interest.
• Analytics and improvement: understanding how the Site is used and improving our platform and content. Legal basis: legitimate interest, or consent where required.
• Legal compliance and enforcement: fulfilling legal obligations, responding to authority requests, and enforcing our Terms and Conditions of Use. Legal basis: legal obligation and legitimate interest.

For users in Brazil, the applicable legal bases are those set out in the LGPD (Lei nº 13.709/2018), principally Articles 7(I), 7(II), 7(V), 7(VI), and 7(IX). For users in the EEA and UK, the applicable bases are those under Article 6 of the GDPR and UK GDPR.

4. How We Share Your Data

We do not sell, rent, or lease your personal data. We share data only as described below, and only with service providers bound by data processing agreements that require them to process data solely on our instructions and to implement appropriate security measures.

• Payment processors: to process subscription payments, manage recurring billing, and handle refunds and disputes.
• Cloud infrastructure and CDN providers: to host our platform and deliver digital content reliably and securely.
• Analytics providers: to measure platform performance and user behaviour, in aggregated or pseudonymised form where possible.
• Email and communications providers: to send transactional and marketing messages.
• Customer support platforms: to manage and respond to support inquiries.
• Legal and regulatory: to courts, regulators, and law-enforcement bodies where required by law, to protect our legal rights, or to prevent or detect fraud or security threats.
• Business transfers: in a merger, acquisition, restructuring, or asset sale, personal data may be transferred to the acquiring entity. We will notify affected users as required by law and ensure the receiving entity is bound by obligations consistent with this Policy.

5. International Data Transfers

Loot Studios operates from Brazil and serves a global user base. Your data may be transferred to and processed in countries with different data-protection rules. When we transfer personal data internationally, we use appropriate safeguards, including:

• adequacy decisions or certifications recognised by the relevant authority;
• standard contractual clauses approved by the European Commission, the UK ICO, or the Brazilian ANPD;
• binding corporate rules or other approved mechanisms under applicable law.

For more information on the safeguards applicable to your data, contact us at privacy@lootstudios.com.

6. How Long We Keep Your Data

We retain data only for as long as necessary for the purposes described in this Policy, or as required by law.

• Account and subscription data: for the life of your account and up to five years after closure, to address legal claims, regulatory inquiries, and tax obligations.
• Payment records: for up to five years, in accordance with applicable tax and financial regulations.
• Download and redemption records: for the life of your account and up to five years after closure, to support enforcement of our Terms and to defend against claims.
• Support records: for up to three years after resolution of your inquiry, unless a longer period is needed for disputes or proceedings.
• Marketing records: for the period of your subscription to marketing communications and for up to two years after unsubscription, to maintain suppression lists.
• Server and access logs: for up to twelve months for security and operational purposes.
• Cookie and analytics data: retained for the period necessary to fulfil the purposes described in this Policy and in accordance with applicable legal and regulatory requirements.

When data is no longer needed, we securely delete or anonymise it.

7. Your Privacy Rights

You have rights over your personal data. The specific rights available to you depend on your location, but in general you may:

Access: request a copy of the personal data we hold about you.

• Correct: request correction of inaccurate or incomplete data.
• Delete: request deletion of your data in certain circumstances, including where it is no longer needed or where you withdraw consent.
• Restrict: ask us to limit how we use your data while a query is resolved.
• Port: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests or for direct marketing. Marketing objections will be actioned immediately.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
• Automated decisions: request human review of any significant decision made solely by automated means.
• Complain: lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at privacy@lootstudios.com. Brazilian users will receive a response within fifteen (15) days, as required by the LGPD. EEA and UK users will receive a response within one (1) month, as required by the GDPR and UK GDPR, with a possible extension of two (2) months for complex requests.

Supervisory authorities:

• Brazil - ANPD: https://www.gov.br/anpd
• European Economic Area (your national authority): https://edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom - ICO: https://ico.org.uk
• Australia - OAIC: https://www.oaic.gov.au

8. Users in Other Jurisdictions

United States: We do not sell personal data as defined under the California Consumer Privacy Act (CCPA) or any other U.S. state privacy law. California residents may request to know, delete, and opt out of any sale of personal information by contacting us at privacy@lootstudios.com.

Canada: We process requests from Canadian users in accordance with PIPEDA and applicable provincial legislation.

Australia: We process requests from Australian users in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Complaints may be directed to the OAIC.

Other jurisdictions: We will process requests in good faith in accordance with applicable local law.

9. Security

We implement technical and organisational security measures proportionate to the risk of our processing activities. These include TLS encryption for data in transit, strong one-way hashing for passwords, least-privilege access controls, infrastructure-level security including firewalls and intrusion detection, system monitoring for anomalous activity, and contractual security obligations on all third-party service providers.

No system is entirely impenetrable. In the event of a data breach likely to affect your rights, we will notify the relevant supervisory authority and, where required, affected individuals, in accordance with applicable law.

10. Children

Our Services are intended for individuals who are legally capable of entering into binding agreements under applicable law. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from someone under 18, please contact us at privacy@lootstudios.com and we will delete it promptly.

11. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date, notify registered users by email, and post a notice on the Site. Continued use of the Services after the effective date of an updated version of this Policy will be deemed acknowledgement of the changes made, without prejudice to any rights granted under applicable law.

12. Contact

For questions, rights requests, or privacy complaints, contact our Privacy Team at privacy@lootstudios.com.

 

Loot Studios - Privacy Team

Kraken Produtos Digitais Ltda.

Belo Horizonte, Minas Gerais, Brazil

 

Effective June 2026 - Loot Studios (Kraken Produtos Digitais Ltda.) - Belo Horizonte, MG, Brazil