Privacy Policy

This Privacy Policy describes how Looosh collects, uses, shares, and protects information when you use the Looosh marketplace. It applies to buyers, sellers, visitors, and anyone interacting with listings, orders, claims, reports, messages, or other marketplace activity.

By using Looosh, you acknowledge the data practices described in this Policy. If you do not agree with this Policy, please do not use the marketplace.

This Policy is incorporated by reference into the Terms of Service and Seller Agreement.

Looosh collects information in several categories to operate the marketplace, complete transactions, and provide trust and safety controls. The specific data collected depends on whether you are a buyer, seller, or visitor.

Account and profile data: name, email address, display name, shop name, seller handle, profile image, bio, shipping origin, and other profile fields you provide.

Listing and content data: listing titles, descriptions, categories, attributes, images, shop branding, and any other content you upload to the marketplace, including messages you send to other users where applicable.

Order and transaction data: items purchased or sold, buyer and seller email addresses, order status, timestamps, item prices, shipping amounts, totals, applied discounts, sale-campaign snapshots, claim records, cancellation records, and review records.

Shipping and address data: buyer shipping addresses (name, street, city, state/region, postal code, country, optional phone), seller fulfillment information, tracking numbers, carrier names, and delivery status.

Payment data: payment provider references (such as Stripe payment intent IDs, charge IDs, and refund references), payment status, payout status, and connected-account status. Looosh does not store full credit card numbers — card data is collected and held by the payment provider.

Seller payout and onboarding data: Stripe Connect (or equivalent) account IDs, account status mirrors, onboarding state, payout readiness, and related compliance flags. Underlying identity verification data is collected directly by the payment provider, not by Looosh.

Reports, moderation, and support data: user reports, evidence uploads, moderation case records, claim evidence (photos, descriptions, return-shipment data), messages to support, and admin notes where applicable.

Operational and audit data: application logs, order and listing state-transition history, audit logs, risk signals, webhook event records, and where applicable, IP address, device information, browser type, and similar technical metadata.

Analytics and usage data: searches performed, listings viewed, feature usage, performance metrics, and error/diagnostic logs.

Payment processing is handled by third-party payment providers, including Stripe. When you pay for an order or onboard as a seller, you interact directly with the payment provider through embedded checkout, Stripe Connect onboarding, or similar flows.

Looosh may receive limited information back from the payment provider, including payment status, payment intent and charge references, refund references, dispute references, payout status, and connected-account status indicators. Looosh does not receive or store full credit card numbers, bank account numbers, or government-issued ID images submitted directly to the provider.

Seller payout onboarding (Stripe Connect or equivalent) involves identity verification, tax-form collection, and compliance checks performed by the payment provider. Information you submit to the provider is governed by the provider's own privacy terms in addition to this Policy.

We may also receive operational information from infrastructure, hosting, email, analytics, error-monitoring, and support providers we use to run the marketplace.

Looosh uses the information described above for the purposes listed below. Where required by applicable law, we rely on the following legal bases for processing: performance of a contract (fulfilling orders, processing payments, and operating the marketplace); compliance with legal obligations (tax, financial recordkeeping, and regulatory requirements); legitimate interests (fraud prevention, security, trust and safety, product improvement, and analytics); and, where applicable, your consent.

• Operating the marketplace and providing the Looosh service; • Creating, authenticating, and maintaining buyer and seller accounts; • Displaying listings, shops, and public-facing seller information; • Processing orders, payments, refunds, and seller payouts; • Coordinating shipping and fulfillment, including sharing buyer shipping addresses with sellers; • Operating buyer protection, claim review, and cancellation governance; • Running trust and safety, content moderation, and fraud-prevention systems; • Providing seller analytics, profitability, inventory, and reporting tools; • Responding to support requests and resolving disputes; • Complying with legal, tax, regulatory, audit, and recordkeeping obligations; • Improving the marketplace, fixing bugs, and developing new features; • Monitoring service health, error rates, and feature usage.

We use information only for purposes consistent with this Privacy Policy and applicable law.

Sellers can enter private operational information including item cost basis, acquisition source, internal SKU, inventory location identifiers, external-marketplace references, and other inventory notes. These fields are intended for the seller and Looosh administrators only.

Seller cost basis, acquisition source, internal SKU, inventory location, and profitability data are not shown to buyers or public listing viewers. The marketplace's public listing views are designed to omit these fields.

Looosh may process these fields to provide seller-only tools (such as profitability reports and inventory search), to deliver support, and to perform compliance and audit functions. Looosh does not use seller cost basis to compete with sellers or to disclose it to buyers.

Looosh uses a combination of automated tools, AI-assisted review, human review, user reports, risk signals, and audit logs to operate trust and safety, support, and quality systems.

Examples of automated tools used include:

• Listing moderation and image moderation; • Content review for prohibited categories and policy violations; • Claim triage and evidence review; • Cancellation reason classification; • Fraud and abuse detection, including shipping and tracking anomaly detection; • Seller standing and reputation signals; • Seller-support tools such as draft assistance and listing improvement suggestions.

Consequential decisions — for example, account suspension, large payout holds, or final claim resolution — involve human review where practicable. Automated tools may flag, prioritize, or take action on low-risk routine cases.

Where automated decision-making produces legal or similarly significant effects on you, you have the right to request human review of that decision, to express your point of view, and to contest the outcome. To do so, contact Looosh support using the details in Section 17.

Looosh shares information only as needed to operate the marketplace and as described below.

With other users to complete transactions: buyers' shipping addresses, names, and order details are shared with the seller fulfilling the order; sellers' shop information, public profile, and listing content are shared with buyers and visitors. Limited contact metadata is shared so the parties can coordinate fulfillment, returns, and claims.

With payment providers: Stripe and other payment providers receive information necessary to process payments, payouts, refunds, and disputes.

With shipping and fulfillment-related providers: where applicable, address information and order references may be shared with carriers or shipping-related providers to support fulfillment, tracking, and dispute resolution.

With infrastructure and operational providers: cloud hosting, file storage, analytics, error monitoring, security, fraud-prevention, email delivery, and customer-support providers may process data on Looosh's behalf, subject to appropriate contractual obligations.

With professional advisors and authorities: legal, accounting, compliance, and audit professionals; law enforcement, regulators, courts, tax authorities, and rights holders where required, appropriate, or to protect Looosh, users, or the public.

In connection with business transfers: in the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, user information may be transferred as part of that transaction, subject to applicable law.

Looosh does not sell personal information to third parties for their independent advertising or marketing purposes.

Some information you provide is intended to be public. This includes listings, listing images, item descriptions, shop names, seller handles (the /shop/<handle> URL), public seller profile fields, and reviews you choose to post publicly.

Seller private fields — cost basis, acquisition source, internal SKU, inventory location, external-marketplace references, and similar operational data — are not part of the public listing view.

Do not include sensitive personal information (such as Social Security numbers, government ID images, payment card numbers, or other people's personal data) in your listings, images, shop branding, messages, or other marketplace content. Looosh may remove content that exposes sensitive information.

Looosh and its service providers use cookies, session storage, local storage, web beacons, and similar technologies for the purposes described below. Where required by applicable law (including the EU ePrivacy Directive and equivalent national laws), Looosh will obtain your consent before placing non-essential cookies on your device.

Cookies and similar technologies are used to:

• Maintain login sessions and authentication state (strictly necessary — no consent required); • Remember preferences and settings (functional — consent required in applicable jurisdictions); • Provide analytics about marketplace performance and feature usage (analytics — consent required); • Monitor service health and detect errors (operational — may be strictly necessary); • Support security, abuse detection, and fraud prevention (security — may be strictly necessary).

You may be able to control cookies through your browser settings or, where a consent banner is presented, through the preference controls provided. Disabling strictly necessary cookies may affect your ability to use the marketplace.

Looosh retains personal information for as long as necessary to operate the marketplace, deliver the service, provide support, and meet legal, tax, accounting, audit, and compliance obligations. The following general retention periods apply, subject to longer retention where required by law or for legitimate purposes such as fraud prevention or dispute resolution:

Anonymized or aggregated data that does not identify a specific person may be retained indefinitely for analytics and product-improvement purposes.

Looosh uses reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, alteration, disclosure, or destruction. Examples include access controls, encryption in transit, role-based permissions for administrative functions, and audit logging.

No system is perfectly secure. If Looosh becomes aware of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware where required by applicable law (including GDPR Article 33), and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

You should choose a strong password, keep your account credentials confidential, sign out of shared devices, and notify Looosh promptly if you suspect unauthorized access.

You may update profile and account information directly in the app where editing tools are provided. You may also remove listings, close your account, and manage certain preferences.

Depending on where you live, you may have additional rights with respect to your personal information. These may include:

• Right of access — to request a copy of the personal information we hold about you; • Right to rectification — to request correction of inaccurate or incomplete information; • Right to erasure — to request deletion of your personal information, subject to exceptions; • Right to restriction — to request that we limit how we use your information in certain circumstances; • Right to data portability — to receive your information in a structured, commonly used format; • Right to object — to object to processing based on legitimate interests or for direct marketing; • Right to withdraw consent — where processing is based on consent, to withdraw it at any time; • Right not to be subject to solely automated decisions with significant effects (see Section 6); • Right to lodge a complaint with your relevant supervisory authority (EU/UK residents may contact their national data protection authority).

To exercise any of these rights, contact us using the details in Section 17. We will respond within 30 days (or the timeframe required by applicable law). We may need to verify your identity before processing certain requests. Some data cannot be deleted because of legal, transactional, audit, or security obligations.

Looosh is not intended for children. As a marketplace that processes payments, facilitates transactions, and creates contractual obligations, users must meet the minimum age required to enter into contracts in their jurisdiction.

Looosh does not knowingly collect personal information from children under 13 (or under the higher age required by applicable law, such as 16 in certain EU member states). If you believe a child has provided personal information to Looosh in violation of this Policy, please contact us and we will take appropriate steps consistent with applicable law.

Looosh is operated from the United States. If you access the marketplace from outside the United States, your information may be transferred to, processed in, and stored in the United States or other countries where Looosh or its service providers operate.

For transfers of personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries not recognized as providing an adequate level of protection, Looosh relies on Standard Contractual Clauses (SCCs) approved by the European Commission (and, for UK transfers, the UK International Data Transfer Addendum) as the lawful transfer mechanism, unless another appropriate safeguard applies.

Looosh is currently in a beta / controlled-launch phase. During this period, Looosh may more closely monitor application errors, support tickets, order flows, claim flows, payment events, moderation outcomes, scheduler runs, and feature usage in order to improve safety, reliability, and product quality.

Beta monitoring is subject to this Privacy Policy. Looosh does not use beta monitoring to bypass user rights, retention rules, or sharing limits described above. Some marketplace features, support workflows, and trust-and-safety controls are still being developed and may continue to evolve.

Looosh may update this Privacy Policy from time to time as the marketplace, applicable law, and data practices evolve. When we make material changes, we will update the date at the top of this page and provide notice by in-app message, email, or other appropriate means at least 14 days before the changes take effect for existing users.

If you do not agree with the updated Policy, you may close your account before the effective date. Continued use of Looosh after the effective date constitutes acceptance of the updated Policy, to the extent permitted by applicable law.

If you have questions about this Privacy Policy, want to exercise a privacy right, or want to report a privacy concern, please contact us:

Email: info@looosh.com

We will respond to privacy rights requests within 30 days (or such other period as required by applicable law) and may need to verify your identity before processing certain requests.