Privacy Policy

Last updated: June 9, 2026
At ZenLootX, your privacy matters. This policy explains what information we collect, how we use it, and what we will never do with it. We keep it simple and honest.

1. Overview

ZenLootX ("we," "us," "our") operates the website at zenlootexchange.com. We are committed to protecting the personal information of every user on our platform — buyers and sellers alike.

The short version: We collect only what we need to operate the marketplace safely. We do not sell your data. We do not share it with advertisers. ID verification is optional (required only to withdraw funds), and your ID documents are private and used solely for that verification.

2. What We Collect

We collect different types of information depending on how you use ZenLootX:

Type What it includes Who it applies to
Account info Username, email address, password (hashed — we never store it in plain text) All users
Profile info Profile photo, bio, member since date, last active timestamp All users
Verification info Full name, phone number, date of birth, country, government-issued ID (front and back), and a verification selfie Only users who choose to complete ID verification — it's optional, but required before withdrawing funds
Wallet & financial info Wallet balance, transaction history (top-ups, purchases, escrow holds, withdrawals), total earnings, platform fee amounts per completed sale (gross amount, 3% fee, net amount paid to seller) Buyers and sellers
Transaction info Listings created, orders placed, purchase amounts, escrow status, order history Buyers and sellers
Communication info Messages sent through the Platform between buyers and sellers All users
Session & device info IP address, browser type, device name, session identifiers, login timestamps — collected to detect unauthorized access and protect your account All users
Notification data In-app notification history (orders, disputes, listings, reviews); push notification subscription token if you enable browser push notifications All users
Tier & activity data Transaction count and volume used to calculate your account tier (Iron, Bronze, Silver, Gold, Sapphire, Diamond) All users
Reports & disputes Report reason and details when you report a user or listing; dispute messages and evidence submitted All users
Email rate data Email address and timestamps of verification/reset emails sent — stored temporarily to prevent spam abuse (auto-deleted after 10 minutes) All users

We do not collect sensitive financial details such as full card numbers directly. Any payment processing for wallet top-ups is handled by our payment partner, which has its own privacy policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To create and manage your account and verify your email address
  • To verify seller identity and maintain marketplace trust
  • To process transactions, manage your wallet balance, and operate the escrow system
  • To calculate and display your account tier based on activity
  • To detect and prevent unauthorized account access using session and device data
  • To communicate with you about your account, orders, or support requests via email and in-app notifications
  • To investigate disputes, fraud, and reported violations
  • To prevent email system abuse through rate limiting
  • To improve the security and performance of the Platform

We will never use your information for purposes beyond what is listed here without asking for your explicit consent first.

4. Storage & Security

Your data is stored on secure servers provided by Supabase, a trusted infrastructure provider based in the United States. All data is encrypted in transit (HTTPS/TLS) and at rest.

ID documents submitted during our optional ID verification are stored in a private, access-controlled storage bucket. They are not publicly accessible and cannot be viewed by other users — only by ZenLootX administrators during the review process.

Session tracking: We record your active login sessions (device name, browser, IP address, and last seen time) so you can review and revoke sessions from your account settings. This data is used solely for your account's security.

Email rate limiting: When you request a verification or password reset email, we temporarily record your email address and the time of the request. This data is automatically deleted after 10 minutes and is used only to prevent spam and abuse of our email system.

We take security seriously, but no system is completely immune to breaches. If a security incident occurs that affects your data, we will notify you as required by applicable law.

5. What We Share (and What We Don't)

We do not sell your personal data. We do not share your personal information with advertisers, data brokers, or marketing companies — ever.

We may share limited information only in the following circumstances:

  • With service providers: We use third-party services that process data on our behalf — Supabase (database and file storage), Resend (transactional email), and Cloudflare (hosting and security). These providers are bound by data processing agreements and may not use your data for their own purposes.
  • For legal reasons: If we are required by law, court order, or government authority to disclose information, we will comply. We will notify you where legally permitted to do so.
  • To protect users: In cases of fraud, scamming, or threats of harm, we may share relevant information with law enforcement or the affected parties.

Between buyers and sellers on the Platform, only your username and public profile information (avatar, bio, tier, rating) are visible. Your email address, phone number, ID documents, wallet balance, and full name are never shown to other users.

6. Data Retention

We keep your data for as long as your account is active or as long as needed to provide our services. If you close your account:

  • Your public profile and active listings are removed
  • Transaction and order records are retained for up to 3 years for legal and dispute purposes
  • ID documents submitted for ID verification are deleted within 90 days of account closure
  • Session and security logs are retained for up to 1 year
  • Email rate limit records are automatically deleted after 10 minutes regardless of account status
  • Push notification subscriptions are removed immediately upon account closure

7. Your Rights

You have the following rights regarding your personal data:

  • Access: You can request a copy of the personal data we hold about you
  • Correction: You can update your account information at any time through the Account settings page
  • Session control: You can view and revoke any active login session from your account settings at any time
  • Deletion: You can request that we delete your account and personal data
  • Portability: You can request your data in a structured, machine-readable format
  • Objection: You can object to certain uses of your data

To exercise any of these rights, contact us at support@zenlootexchange.com. We will respond within 30 days.

8. Cookies & Local Storage

ZenLootX uses minimal browser storage to operate the Platform. Here is what we use and why:

  • Session tokens (Local Storage): When you log in, your authentication token is stored in your browser's local storage so you stay logged in across pages. This token is sent with requests to verify your identity. You can clear it by logging out.
  • Session row ID (Local Storage): A reference to your current login session is stored locally so the Platform can detect if your session was revoked from another device.
  • HttpOnly cookies: For certain administrative functions, a secure HttpOnly cookie may be set. This cookie is not accessible to JavaScript and cannot be read by third-party scripts.

We do not use advertising cookies, tracking pixels, or any third-party analytics scripts. We do not use Google Analytics or similar tools.

You can clear local storage and cookies at any time through your browser settings. This will log you out of ZenLootX.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

For significant changes, we will notify registered users via email.

10. Contact

If you have questions, concerns, or requests about your privacy, contact us:

This Privacy Policy is governed by the laws of the Republic of the Philippines.