Privacy Policy

1. Who we are

MyLoot.ai is operated by Stowed LLC ("Stowed", "we", "us", "our"), a limited liability company organized in the United States. Stowed LLC is the data controller for the personal data processed through the MyLoot.ai website and applications (the "Service").

Contact: privacy@myloot.ai

2. What we collect

Information you give us

• Account data: your email address, display name, and authentication credentials (or a Google account identifier if you sign in with Google).
• Vault data: the items you record — names, brands, models, serial numbers, conditions, locations, purchase prices, estimated values, warranty dates, notes, collections, sale and trade records, and value history.
• Files you upload: photos of your items and documents such as receipts and appraisals.
• AI interactions: photos you submit for identification and the questions you ask MyLoot AI, together with the answers returned.
• Support communications: messages you send us.

Information collected automatically

• Log and device data (IP address, browser type, pages visited, timestamps) used for security, debugging, and abuse prevention.
• Basic, aggregate usage analytics. We do not use third-party advertising trackers or sell your data.

3. How we use your data

• To provide the Service: store and display your vault, value history, collections, activity timeline, and audit suggestions.
• To run AI features you request: identifying items from photos, estimating values, and answering questions about your own records.
• To secure your account, prevent fraud and abuse, and enforce our Terms of Use.
• To communicate with you about your account and important service changes.
• To comply with legal obligations.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

4. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal data on these bases:

• Contract — to provide the Service you signed up for (account, vault, AI features you invoke).
• Legitimate interests — security, fraud prevention, service improvement, and aggregate analytics, balanced against your rights.
• Consent — where required, for optional features; you may withdraw consent at any time.
• Legal obligation — where we must retain or disclose data by law.

5. AI processing

When you use photo identification or MyLoot AI, the relevant photo, question, and your item records are sent to our AI processing provider solely to produce the answer you requested. AI outputs are estimates and suggestions only — see our Terms of Use. We do not use your vault data, photos, or documents to advertise to you, and we do not sell them.

6. Who we share data with

• Infrastructure and hosting providers that store and serve the app and its database under contract.
• AI processing providers, only when you use an AI feature and only with the data needed for that request.
• Authentication providers (e.g., Google) when you choose to sign in with them.
• Authorities where required by law, subpoena, or to protect rights, safety, and security.
• Successors in a merger, acquisition, or sale of assets, subject to this Policy.

We never sell your personal information.

7. International transfers

We are based in the United States and your data is processed there. For EEA/UK users, transfers rely on appropriate safeguards such as the EU–US Data Privacy Framework (where the recipient is certified) or Standard Contractual Clauses approved by the European Commission.

8. Retention

We keep your data while your account is active. When you delete your account, we delete or anonymize your personal data within 90 days, except where we must retain it for legal, tax, or security reasons. Backups cycle out within the same period.

9. Your rights

Everyone

• Access, correct, export, or delete your data. Much of this is self-serve in the app; otherwise email privacy@myloot.ai.
• Delete your account at any time from your Profile.

EEA/UK users (GDPR)

• Access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with your local supervisory authority.

US state residents (including California, Virginia, Colorado, Connecticut, and others)

• Know and access the personal information we hold about you.
• Correct inaccuracies and request deletion.
• Opt out of sale or sharing for targeted advertising — we do not sell or share your data in this way, so there is nothing to opt out of.
• Non-discrimination for exercising your rights.
• California residents: we do not collect "sensitive personal information" for purposes requiring a "Limit the Use" link under the CCPA/CPRA.

To exercise any right, email privacy@myloot.ai. We will verify your identity and respond within the time required by applicable law (generally 30 days under GDPR, 45 days under US state laws).

10. Security

We use encryption in transit, access controls, and row-level isolation so each user can only reach their own records. Uploaded files are stored in private storage scoped to your account. No method of transmission or storage is 100% secure; if a breach affects your data we will notify you and regulators as required by law.

11. Children

The Service is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this Policy. Material changes will be announced in the app or by email before they take effect. The "Last updated" date above shows the current version.