FunLoot

Privacy Policy

Effective date: April 17, 2026 · Last updated: September 24, 2026

This Privacy Policy explains how FunLoot ("we", "us", or "our") collects, uses, discloses, and safeguards your information when you use the FunLoot mobile application (the "App") and related services. By using the App you agree to the terms described here. If you do not agree, please do not use the App.

FunLoot is operated from the Kingdom of Saudi Arabia. This policy is written to comply with the Saudi Personal Data Protection Law (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR) and Apple's App Store requirements.

1. Information We Collect

1.1 Information you provide

• Phone number — required to create an account and sign in via one-time password (OTP).
• Name — your first and last name, used to personalize the app and display on orders, auction bids, and grading submissions.
• Shipping and pickup addresses — used only to deliver orders and arrange PSA grading pickup.
• Payment information — processed by our payment provider. We do not store full card numbers on our servers.
• Grading submission details — the cards you submit for PSA grading, including photos and declared values.
• Customer support messages — content of messages you send us and our replies.

1.2 Information collected automatically

• Device identifiers — a randomly generated installation ID used for authentication session management and analytics. On Android, our analytics provider (Google Analytics for Firebase) also reads your device's advertising ID; you can reset or delete it in your device's Google settings. The iOS App does not use Apple's advertising identifier (IDFA).
• Purchase history — the record of your orders, auction wins, grading submissions, and loyalty point activity.
• Usage data — which screens you visit and which actions you take, such as purchases, collected through Google Analytics for Firebase and PostHog and used to improve the App and to understand which campaigns bring people to FunLoot.
• Approximate location — the city or region inferred from your IP address by our analytics provider. The App never reads your device's GPS.
• Crash reports — technical diagnostics when the App crashes, which do not include your name or phone number.
• Push notification token — if you turn on notifications, your device's push token, used only to send you order and account updates.

1.3 Information we do NOT collect

• Biometric data — if you enable Face ID or Touch ID, the authentication happens entirely on your device through Apple's secure enclave. Your biometric data never leaves your device and is never transmitted to or stored by FunLoot.
• Precise location — the App does not request location permission and never accesses your device's GPS or precise location.
• Apple's advertising identifier (IDFA) — the iOS App does not use it, and we do not show ads or run advertising SDKs inside the App. On Android, see Device identifiers above.
• Contacts, photos, calendar, health data — we do not request access to any of these.

2. How We Use Your Information

• To create and secure your account, including sending OTP codes via SMS.
• To process orders, auction bids, PSA grading submissions, and payments.
• To operate and maintain the FunLoot loyalty program, including calculating your membership tier.
• To send you transactional notifications about orders, grading status, and account activity.
• To understand how the App is used and which campaigns bring people to FunLoot, through analytics.
• To provide customer support and respond to your inquiries.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with applicable laws and regulatory obligations in Saudi Arabia.

3. Legal Basis for Processing

We process your personal data on one or more of the following legal bases:

• Contract — to provide the App and services you've signed up for.
• Legitimate interests — to secure our systems, prevent fraud, and improve the App.
• Consent — for optional features such as push notifications, which you can turn off at any time in your device settings.
• Legal obligation — where required by Saudi law or other applicable regulations.

4. Who We Share Information With

We share your information only with the following categories of service providers, each bound by data protection obligations:

Provider	Purpose
Supabase (Auth)	Phone OTP authentication and session management
Our commerce backend (Medusa, self-hosted)	Order processing, auctions, loyalty program, customer records
Paymob	Secure card processing and payment authorization
PSA Grading Services	Card authentication and grading (only submission details)
Shipping and pickup partners	Order delivery and grading pickup
Apple (App Store, push notifications)	App distribution and transactional notifications
Google (Firebase Analytics, Firebase Cloud Messaging)	App analytics, and push notification delivery on Android
PostHog	Product analytics (linked only to your FunLoot account ID)
Sentry	Crash reporting and diagnostics
Expo	Push notification delivery
Tabby and Tamara	Buy-now-pay-later payments, when you choose them

We do not sell your personal data, and we do not share it with advertisers or data brokers.

5. International Data Transfers

Some of our service providers (including Supabase) may process data outside the Kingdom of Saudi Arabia, including in the United States and the European Union. Where data is transferred internationally, we rely on contractual safeguards and, where applicable, Standard Contractual Clauses or equivalent protections recognized under the Saudi PDPL.

6. Data Retention

• Account data (phone, name) — kept for as long as your account is active. If you delete your account, we delete this data within 30 days, except where retention is required by law (e.g., tax records).
• Order and transaction records — retained for a minimum of 10 years to comply with Saudi commercial and tax law.
• Customer support messages — retained for 2 years after the last interaction.
• Crash and usage logs — retained for 90 days in identifiable form, then aggregated.

7. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data (subject to legal retention requirements).
• Export a copy of your data in a portable format.
• Object to or restrict certain processing activities.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your rights have been violated.

To exercise any of these rights, contact us at support@funloot.com. We respond within 30 days.

8. Security

We take reasonable technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS 1.2 or higher) for all network communication.
• Encryption at rest for databases containing personal data.
• Credentials stored on your device are protected by the iOS Keychain and, when you enable it, gated behind your device's biometric lock (Face ID or Touch ID).
• Access controls limiting which FunLoot personnel can view personal data, on a need-to-know basis.
• Regular security reviews of our infrastructure and dependencies.

No method of transmission or storage is 100% secure. In the event of a data breach that affects your personal data, we will notify you and the relevant authorities as required by law.

9. Children's Privacy

The FunLoot App is intended for users aged 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

10. Third-Party Links

The App may contain links to websites or services operated by third parties. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy practices before providing any information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide notice through the App or by email. Your continued use of the App after a change becomes effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: