Privacy Policy

LootSaver LLC ("LootSaver," "we," "us," or "our") provides the LootSaver mobile application, web application, public website, and related services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use and disclose it, how long we retain it, and the choices available to you.

The Service is intended for people in the United States who are at least 18 years old.

1. Information We Collect

LootSaver provides a notice before account creation and again before a user starts a new financial-account connection. Those notices summarize the categories collected, the purposes described below, household sharing, and links to this Policy. The account-connection notice appears before LootSaver requests a Plaid link token or opens Plaid Link.

Account and Household Information

We collect information needed to create and manage your account and household, including:

• email address, display name, account identifier, and email-verification status
• authentication provider information when you sign in with Apple or Google
• household membership, role, invitations, and member activity
• support contact information and communications with us
• legal-policy acceptance records

Authentication is provided through Amazon Cognito. LootSaver does not store your password in plaintext.

Financial Information You Provide or Import

We collect financial information that you enter, upload, or create in the Service, including:

• income, expenses, assets, debts, balances, and ownership information
• bills, obligations, due dates, payment records, and autopay settings
• goals, scenarios, preferences, notes, categories, and tags
• transaction data imported from files such as CSV files
• feedback and corrections you provide about transactions, matches, bills, and insights

Financial Information from Plaid

When you choose to connect a financial institution through Plaid, we may receive:

• institution and account information, including account type, balance, and masked account number
• transaction history, dates, amounts, merchant or description information, pending status, and categories
• connection, consent, synchronization, and error information needed to maintain the link
• other financial information your institution makes available through the Plaid products you authorize

LootSaver does not receive or store the username or password you use to sign in to your financial institution. Plaid handles that authentication. We do store protected authorization references needed to maintain and synchronize the connection.

Purchases and Subscriptions

When you purchase, restore, or manage a subscription through the Apple App Store, Google Play, or LootSaver's direct web checkout processed by Stripe, we receive information needed to provide and support the subscription, including:

• product and plan selected
• purchase, transaction, and subscription references
• price, currency, billing interval, and limited tax and payment-status information
• subscription status, renewal and expiration information, and storefront environment
• refund, dispute, revocation, grace-period, billing-recovery, and acknowledgement status
• limited diagnostics needed to verify the purchase and prevent duplicate or cross-account grants

Apple, Google, or Stripe processes your payment method. LootSaver does not receive or store your full payment-card number, card security code, or store-account credentials.

Device, Notification, Usage, and Diagnostic Information

We collect limited technical and operational information, including:

• IP address, browser or user-agent information, request identifiers, and timestamps
• platform, app version, locale, time zone, and an app-generated device identifier
• push-notification registration token, permission status, preferences, delivery status, and interactions
• screens or product surfaces used, feature interactions, and bounded event types
• sanitized error category and code, fatal-status indicator, service response status, latency, and reliability diagnostics

We do not use advertising identifiers, collect precise GPS location, or operate third-party advertising trackers. An IP address may reveal a general region, but we do not use it to track precise location. Client error telemetry is designed not to send raw stack traces, financial values, merchant descriptions, or free-form error messages.

Explanations, Feedback, and Generative AI

LootSaver records limited interaction information about explanations and insights, such as whether a card was rendered, expanded, collapsed, or rated helpful. An opaque render identifier may be used for a limited time to measure whether an explanation preceded a later correction or reversal. Client explanation telemetry is designed not to contain transaction identifiers, account identifiers, amounts, balances, merchant names, descriptions, or raw notes.

Some paid explanation features use Amazon Bedrock. When you use such a feature, LootSaver sends Amazon Bedrock:

• the question or prompt selected in the Service
• a bounded, sanitized subset of the financial and planning context already visible to you
• reason codes, source domains, confidence, freshness, limitations, and related explanation context

These AI features are display-only. They do not calculate financial truth, change balances, rank actions, move money, grant entitlements, or autonomously alter your plan. LootSaver records limited operational metadata about an AI request, such as the feature surface, result class, duration, and guardrail outcome; it does not place the full AI prompt or response into client telemetry.

Amazon states that Amazon Bedrock does not share customer prompts or outputs with model providers and does not use them to train foundation models. LootSaver does not use your financial information to train a third-party general-purpose AI model.

Website Storage Technologies

Our web experiences may use cookies, local storage, session storage, or similar technologies when needed to:

• authenticate users and protect sessions
• remember preferences
• maintain security and service continuity
• measure first-party product reliability and usage

We do not use these technologies for third-party advertising or cross-context behavioral advertising.

2. How We Use Information

We use information to:

• provide, secure, maintain, and support the Service
• connect and synchronize financial accounts at your direction
• calculate deterministic balances, projections, classifications, goals, bills, and planning context
• provide explanations, insights, reminders, and notification preferences
• verify purchases, manage subscriptions, and prevent duplicate or unauthorized entitlement grants
• personalize household and product experiences
• detect, investigate, and prevent fraud, abuse, security incidents, and service misuse
• diagnose errors, monitor reliability, and improve product features and deterministic rules
• respond to support, privacy, and account requests
• enforce our Terms of Service and comply with legal, tax, accounting, regulatory, and audit obligations

We do not use generative AI to make autonomous financial decisions for you.

3. How Information Is Shared

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not serve third-party ads.

Other Household Members

LootSaver is household-scoped. If you join or invite others to a household, authorized household members can access shared household financial information, including linked accounts, transactions, bills, goals, plans, and activity. Do not add a person to your household unless you intend to share household information with that person.

If you leave or delete your account from a multi-member household, information that is part of the shared household record may remain available to the remaining household members. Deleting the entire household removes shared household data subject to the retention exceptions below.

Service Providers and Platforms

We disclose information to service providers only as needed to perform services for LootSaver, including:

• Amazon Web Services, including Cognito, storage, processing, logging, security, and Amazon Bedrock
• Plaid for financial-account connection and synchronization
• Apple and Google for authentication, app distribution, subscription verification, and purchase lifecycle events
• Stripe for direct web checkout, payment processing, subscription management, refunds, and disputes
• Firebase Cloud Messaging for push-notification delivery

These providers process information under their own terms and privacy commitments and, where applicable, contractual restrictions with LootSaver.

Authorized Personnel

Authorized LootSaver personnel may access information when reasonably necessary for support, security, privacy requests, commerce verification, incident response, legal compliance, or service operations. Administrative access is role-restricted and audited.

Legal, Safety, and Business Events

We may disclose information:

• to comply with law, legal process, or lawful government requests
• to protect users, LootSaver, or others from fraud, abuse, security threats, or harm
• to establish, exercise, or defend legal claims
• as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law

Aggregated or De-Identified Information

We may use or disclose information that has been aggregated or de-identified so that it cannot reasonably identify you. We do not attempt to re-identify de-identified information except to test whether our de-identification controls work.

4. Data Storage and Security

LootSaver stores and processes information in the United States. We use safeguards designed to protect information, including encryption in transit and at rest, customer-managed encryption keys for core data, protected provider references, access controls, authentication, network protections, monitoring, logging, audit trails, and deletion protection for production data stores.

No security measure is perfect. We cannot guarantee that information will never be accessed, disclosed, altered, or destroyed without authorization.

5. Data Retention

We retain information for the period needed for the purpose for which it was collected and according to the following general schedule:

• account and current household financial records: while the account or household is active, then deleted through the applicable account-deletion workflow, subject to the exceptions below
• service and worker logs: generally 14 to 90 days
• graph snapshots and short-lived explanation correlation records: generally 30 to 90 days
• disabled notification-device records: up to 180 days
• household activity, notification, and intelligence-action history: up to 2 years
• commerce events and provider-verification diagnostics: up to 3 years
• governed audit, legal, privacy-request, financial-history, and compliance records: up to 7 years when needed for legal, tax, accounting, security, fraud-prevention, audit, or operational-integrity purposes
• production backup and point-in-time recovery data: up to 35 days after the source data is deleted

Some records may be retained longer if required by law, legal process, an active dispute, or a security investigation. Some records may be deleted sooner when they are no longer needed.

6. Account Deletion, Access, and Correction

You can use the Privacy & Data controls in the Service to request a copy of data, submit a correction request, review correction-request status, appeal a completed correction review, or start account deletion. You can also visit https://lootsaver.com/delete-account/ or contact us.

A self-service export includes core household financial data visible to the requesting member. Because LootSaver is household-scoped, that portable export can contain shared financial information entered, connected, or contributed by other authorized members of the same household. Generate or share an export only if you are authorized to handle that shared information. The export intentionally excludes secrets and provider credentials and may not include every operational, security, audit, or commerce record associated with your account. You may contact us for a broader access request where applicable.

Correction and appeal requests are authenticated and acknowledged when submitted. They create a governed review case and do not directly change balances, transactions, classifications, or other financial truth. LootSaver records the original response deadline, any permitted extension, customer-visible updates, and completion evidence. Where California's request timing rules apply, LootSaver acknowledges requests no later than 10 business days and responds within 45 calendar days, subject to one additional 45-day extension with notice when permitted.

When an account is deleted:

• user-specific account and identity records are removed from active systems
• connected financial-provider credentials are revoked when the household is deleted
• shared household information may remain for remaining household members when only one member deletes or leaves
• limited legal, security, fraud-prevention, commerce, privacy-request, and audit records may remain for the retention periods described above
• deleted information may remain in protected backups for up to 35 days before aging out

You may also:

• correct information in the Service
• disconnect a linked financial institution
• manage notification permissions and categories
• reject or correct suggested matches and detected obligations
• contact us to exercise applicable privacy rights

We may need to verify your identity before completing a request.

7. U.S. State Privacy Rights

Depending on where you live and subject to applicable law, you may have rights to:

• know or access the categories and specific pieces of personal information we process
• correct inaccurate personal information
• delete personal information
• obtain a portable copy of certain information
• opt out of a sale, sharing for cross-context behavioral advertising, or targeted advertising
• limit certain uses of sensitive personal information
• appeal a decision concerning a privacy request
• receive equal service and pricing without unlawful discrimination for exercising a privacy right

LootSaver does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We use sensitive financial information to provide and secure the financial service you request, not to infer unrelated characteristics about you.

To submit an access, correction, appeal, or deletion request, use the in-app Privacy & Data controls or email support@lootsaver.com. You may also visit https://lootsaver.com/delete-account/ for account-deletion instructions. If an authorized agent submits a request for you, we may require proof of authorization and identity verification.

8. Children

The Service is not directed to anyone under 18, and our Terms of Service require users to be at least 18. We do not knowingly collect personal information from children. If you believe a person under 18 has provided information to us, contact support@lootsaver.com.

9. Third-Party Services and Links

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own policies. Your decision to connect a financial institution, use a social sign-in provider, enable push notifications, or make an app-store purchase may cause the relevant third party to process information independently from LootSaver.

10. Do Not Track and Global Privacy Controls

Because LootSaver does not sell personal information or use cross-context behavioral advertising, browser Do Not Track or Global Privacy Control signals do not change those practices. Where a legally recognized signal applies to a future processing activity, we will honor it as required by law.

11. Changes to This Policy

We may update this Privacy Policy as the Service or applicable law changes. We will post the updated policy with a new effective date. If a change materially affects how we use personal information, we will provide additional notice through the Service, email, or another appropriate channel as required by law.

12. Contact Us

LootSaver LLC
204 Hilton Head Dr
Benton, LA 71006
United States

Email: support@lootsaver.com
Website: https://lootsaver.com