Privacy Policy

Who we are

Lootrunners (“Lootrunners,” “we,” “us”) provides an agent-spend control platform — agent identities, Runs, Resource access, spending mandates and authority, policy evaluation, human approvals, evidence and outcome records, accounting records, AI-assisted analysis (Scout), a public read-only wallet analyzer, and an agent-facing API — together with a separate contractor-payout workflow (customer-controlled stablecoin pay cycles, payment requests, wallet verification, payment evidence, and reconciliation). This Policy applies to information we process through our website and the Service.

For most data about contractors and clients, the Customer (the organization using the Service) is the controller and Lootrunners acts as a processor on its behalf. For our website, account administration, and billing, Lootrunners is the controller.

Information we collect

We collect the following categories of information:

• Account data: names, work email, role, organization details, and authentication data for users who create or manage a workspace.
• Agent & Run data: agent identity, connection and runtime metadata, Run objectives, tool and action events, policy decisions, and outcomes.
• Resource & integration data: connected services, Resource identifiers, access grants, observation and provenance records, tool metadata, and health, plus information exchanged with accounting and payment tools you connect (such as QuickBooks Online, Xero, or Stripe).
• Financial-control data: mandates, rules, approvals, exceptions, spend intents, payment and settlement records, evidence, fees, and reconciliation records.
• AI usage data: questions and prompts, the permitted workspace context used to answer them, model and provider metadata, and usage, token, and cost records for configured AI features.
• Contractor & recipient data: legal or business name, country, address, tax residency, engagement type, tax forms, and payout preferences, submitted by contractors or by the Customer.
• Engagement & financial records: clients, projects, budgets, milestones, invoices, approvals, payout instructions, fees, and reconciliation records.
• Payment-related data: wallet addresses, supported networks, payment destinations, wallet verification events, transaction hashes, test-payment records, settlement status, receipts, fees, and reconciliation records. Lootrunners does not collect or store customer private keys.
• Usage & device data: log data, IP address, device and browser information, and product interactions, collected to operate and secure the Service.

How we use information

We use information to operate and secure the Service; authenticate users and agents; record Runs; evaluate Resource access and spending authority; route approvals; execute or observe authorized activity through configured integrations; reconcile financial records; maintain evidence and audit history; operate Scout and other configured AI features; detect abuse or security problems; provide support; and improve the Service.

The separate contractor-payout workflow additionally uses information to operate payment requests, wallet verification, test payments, pay-run preparation, settlement monitoring, receipts, and accounting exports. We do not sell personal information.

We may use aggregated or de-identified data, which does not identify any individual, for analytics and product development.

Legal bases

Where the GDPR or similar laws apply, we process personal data on the basis of: performance of a contract; compliance with legal obligations (including AML and sanctions requirements); our legitimate interests in operating and securing the Service; and consent where required. Where we act as a processor, we process data under our agreement with the Customer.

How we share

We share information only as needed to run the Service:

• Blockchain networks & infrastructure: public blockchain networks and the wallet-connection, node, and RPC providers used to prepare, broadcast, and confirm the payments a Customer signs and funds from its own wallet. Lootrunners does not custody, convert, or transmit funds.
• AI model providers: when you use Scout (our AI assistant), your question and the permitted workspace context are sent to OpenRouter, which routes the request to an underlying large-language-model provider selected at request time. Requests may be proxied through Cloudflare AI Gateway for reliability and cost control, with prompt-content logging disabled. Under our provider's terms your data is not used to train models. See our sub-processor list for details.
• Service providers: vendors that host infrastructure, process data, or provide support under contractual confidentiality and security obligations.
• Integrations you authorize: accounting and payment systems you connect to your workspace.
• Legal & safety: authorities or parties where required by law, to enforce our terms, or to protect rights, safety, and the integrity of the Service. In a merger or acquisition, data may transfer as part of the transaction.

International transfers

We operate globally and may transfer and process information in countries other than where it was collected, including the United States. Where required, we use appropriate safeguards for cross-border transfers, such as the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.

Retention

We retain information for as long as needed to provide the Service and for legitimate business and legal purposes, including tax, accounting, audit, and compliance obligations, which may require retaining certain financial and transaction records for several years. When information is no longer needed, we delete or de-identify it.

Security

We use technical and organizational measures designed to protect information, including encryption in transit, least-privilege access controls, multi-factor authentication, payment-destination controls and holds, signed webhook validation, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of California and certain other states may have rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information; we do not sell personal information. These rights are subject to the retention obligations described above: certain financial, transaction, audit, and evidence records are kept in an immutable form for legal, accounting, and compliance purposes and cannot be erased on request while those obligations apply. We will tell you when an exception prevents us from fulfilling a request.

If a Customer controls your data (for example, your agency or the agency that engaged you), please direct requests to that organization; we will assist them as a processor. Otherwise, you can contact us using the details below. We will not discriminate against you for exercising your rights.

Cookies & analytics

We use necessary cookies to operate the Service and may use limited analytics to understand usage and improve the product. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required, we request consent for non-essential cookies.

Contractor data

When a Customer invites a contractor or vendor, that individual provides information to be paid through the Service. The Customer determines how that information is used within its workspace. We process it to deliver the Service, prepare and record the payments the Customer signs and funds from its own wallet, and meet compliance obligations, and we make payment-history and document records available to the contractor through their portal.

Children’s privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will take appropriate steps to delete it.

Changes

We may update this Policy from time to time. If we make material changes, we will provide notice by posting the updated Policy with a new effective date or by notifying you in the Service. Your continued use after changes take effect constitutes acceptance.

Contact

For privacy questions or to exercise your rights, contact our privacy team.

Lootrunners  ·  Chicago, IL  ·  [email protected]