Company
About Loofta
Loofta Inc. builds Loofta Pay: a non-custodial way to send, receive and cash out money across crypto and local currencies, without anyone holding your funds but you.
Who we are
Loofta Inc. is a Delaware corporation. We build payment tools for people who get paid in many places at once: creators, freelancers, web3 contributors and distributed teams. Our product, Loofta Pay, lives at pay.loofta.com.
We are a small team and we ship fast. Most of what we build comes from watching real people lose time and money to slow, expensive, confusing payment rails.
Why we exist
Getting paid across borders is still painful. Wire fees eat a chunk of every transfer, platforms hold your money for days, and a lot of people are asked to create an account or a wallet before they can even receive what they earned.
We think you should be able to share a link, get paid in the token you want, and move it to your own wallet or out to cash in a few taps. No invoice chasing, no seed phrases to explain, no gatekeeping.
What you can do
- Send and receive. Pay anyone by email, username or social handle. They claim it from a link, with no wallet address to copy.
- Payment links. Create a link for a fixed amount and share it anywhere. Payers can use any supported token, a card or Naira.
- Cash out. Withdraw to USD through Peer Cash, to Naira through PAJ Cash, or to any crypto.
- Private payments. Hide amounts and wallets on-chain using MagicBlock.
- Giveaways and rewards. Run escrow-funded giveaways with a verifiable on-chain draw, and earn rewards for using the app.
Non-custodial by design
Your funds stay in wallets you control. Loofta never holds your keys and we are not a bank, an exchange or a custodian. When you sign in, an embedded wallet is created for you and unlocked with a passkey, so there is no 12-word phrase to lose.
That is also why some things are your responsibility: blockchain transactions cannot be reversed, and we cannot recover funds sent to a wrong address. The Terms of Service below spell this out in full.
Partners
We do not do everything ourselves. We work with specialised partners for swaps and bridging (NEAR Intents), private payments (MagicBlock), wallets and sign-in (Privy), card on-ramps (MoonPay and Coinbase), and fiat off-ramps (Peer and PAJ Cash). We try to be clear about who does what at every step, and each partner's own terms apply to the part of the flow they run.
Company details
Loofta Inc.
A Delaware corporation
131 Continental Dr, Suite 305
Newark, DE 19713, USA
Website: loofta.com
Support
Questions, problems with a payment, or a legal request? Email hello@loofta.xyz or message us in the Telegram support chat.
Legal
Terms of Service
Effective date: August 10, 2026
1. Acceptance of Terms
These Terms of Service ("Terms") constitute a legally binding agreement between you ("User," "you," or "your") and Loofta Inc., a Delaware corporation with a registered address at 131 Continental Dr, Suite 305, Newark, DE 19713, USA ("Company," "we," "us," or "our"), governing your access to and use of the Loofta Pay application, website, and all related services (collectively, the "Service") available at pay.loofta.com and related domains.
By creating an account, connecting a wallet, or otherwise accessing the Service, you confirm that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. Your continued use of the Service constitutes ongoing acceptance of any updates to these Terms.
2. Description of Service
Loofta Pay is a non-custodial payment platform built on the Solana blockchain that enables users to:
- Send and receive USDC payments on Solana using shareable payment links, usernames, email addresses, or wallet addresses.
- Create reusable payment request links that can be shared with payers.
- Deposit supported tokens from other chains into your Loofta balance via third-party cross-chain protocols.
- Withdraw USDC to external Solana wallets or to other supported chains via third-party bridge protocols.
- Withdraw USDC as Nigerian Naira (NGN) to a linked bank account via a third-party fiat off-ramp partner, where available.
- Purchase tickets in Megapot, a third-party, blockchain-based lottery, for a chance to win a prize pool.
- Purchase Mystery Packs, a chance-based feature that allocates a randomized number of Megapot tickets.
- Create, fund, or enter giveaways distributed through the Service.
- View complete transaction history.
- Earn rewards through our loyalty and referral program.
The Service operates on the Solana mainnet. Certain features may be in beta, limited to invited users, or subject to additional restrictions as disclosed in the application.
3. Eligibility
To use the Service, you must:
- Be at least 18 years of age, or the age of majority in your jurisdiction if higher.
- Have the legal capacity to enter into a binding contract.
- Not be located in, organized under the laws of, or ordinarily resident in a jurisdiction subject to comprehensive sanctions administered by the U.S. Office of Foreign Assets Control (OFAC), including but not limited to Cuba, Iran, North Korea, Syria, Russia (as applicable), and the Crimea, Donetsk, and Luhansk regions.
- Not be designated on any U.S., EU, UN, or UK sanctions list.
- Not be using the Service on behalf of a person or entity that is ineligible.
By using the Service, you represent and warrant that you meet all eligibility requirements. We reserve the right to restrict access to the Service in any jurisdiction at our sole discretion.
Certain features — including Megapot, Mystery Pack, and giveaway features described in Sections 8 through 10 — may be classified as games of chance and may be restricted, illegal, or separately regulated in your jurisdiction. It is solely your responsibility to determine whether your access to and use of these features is lawful where you are located, and we accept no liability for your use of these features in violation of local law.
4. Accounts & Identity
Authentication and identity management for the Service is provided by Privy, Inc. ("Privy"). You may register and log in using your email address or your X (formerly Twitter) account. By logging in, you authorize Privy to create and manage an embedded Solana wallet on your behalf, and you agree to Privy's own terms of service and privacy policy.
You are responsible for maintaining the confidentiality of any credentials used to access your account and for all activities that occur under your account. You agree to notify us immediately at hello@loofta.xyz if you suspect any unauthorized use of your account.
We link your Privy user identifier to your Loofta profile and transaction history stored in our database. You may also connect an external Solana wallet (e.g., Phantom). You are solely responsible for the security and backup of any external wallet private keys.
We reserve the right to suspend or terminate your account if we determine, at our sole discretion, that you have violated these Terms, provided false information, or engaged in any prohibited activity.
5. Non-Custodial Nature
Loofta Pay is a non-custodial service. We do not hold, control, or take custody of your funds, private keys, or digital assets at any time.
Your Solana wallet — whether an embedded wallet created and secured by Privy or an external wallet you connect — is controlled exclusively by you. Loofta facilitates transaction construction and submission on your behalf using keys that you authorize; we do not have the ability to move your funds without your explicit approval for each transaction.
As a consequence of our non-custodial architecture:
- We cannot reverse, cancel, or recover transactions once they are submitted to the Solana blockchain. Blockchain transactions are generally irreversible.
- If you lose access to your wallet credentials or seed phrase, we cannot recover your funds.
- We are not responsible for losses resulting from your own actions, errors, or failure to maintain secure access to your wallet.
- We are not a bank, payment processor, money transmitter, or financial institution. We do not provide deposit insurance (e.g., FDIC or SIPC coverage).
6. Fees
Loofta charges a platform fee on each payment transaction. The current fee structure is:
- A USDC fee of 10 basis points (0.10%) of the transaction amount.
- A network cost component of approximately 0.002 SOL (converted to USD equivalent at the time of the transaction) to cover on-chain transaction costs.
Fees are displayed to you before you confirm any transaction. We reserve the right to modify our fee structure at any time with reasonable notice. Continued use of the Service after a fee change constitutes acceptance of the new fee structure.
In addition to platform fees, Solana network fees ("gas fees") apply to all on-chain transactions. These are separate from, and not retained by, Loofta. Cross-chain deposit and withdrawal operations facilitated by third-party protocols may also incur their own fees, which are disclosed by those protocols at the time of the operation.
7. Transactions & Payments
The primary token supported by the Service is USDC (USD Coin) on the Solana blockchain. By sending or receiving a payment through the Service, you agree that:
- You are initiating a real blockchain transaction that, once confirmed, is irreversible.
- You have verified all recipient details (address, username, or payment link) before confirming a transaction.
- You are responsible for ensuring that any recipient address or entity you are paying is lawful and that you are permitted to make the transfer.
- Payment links generated by you may be used by any person with access to the link. You are responsible for distributing your payment links only to intended recipients.
Cross-chain deposits: Deposits from other chains or tokens are facilitated by third-party protocols including Defuse Protocol and Near Intents. These operations are subject to the terms and conditions of those protocols. Loofta does not control cross-chain bridging infrastructure and is not responsible for delays, failures, or losses that occur within those third-party systems.
Withdrawals: USDC withdrawals to external Solana wallets are processed on-chain. Cross-chain withdrawals (beta) are routed through third-party bridge protocols. Withdrawal addresses are subject to compliance screening as described in Section 12.
8. Megapot & Prize-Based Features
The Service provides access to Megapot, a blockchain-based lottery operated by an independent third-party protocol. You may use USDC held in your Loofta balance to purchase Megapot tickets for a chance to win a prize pool. By purchasing a ticket, you acknowledge and agree that:
- Ticket purchases are final once submitted on-chain and are non-refundable, including if you do not win.
- Winners are selected through a drawing mechanism operated and controlled by Megapot, not by Loofta. We do not control, operate, guarantee, or take responsibility for the outcome, timing, fairness, or integrity of any drawing.
- Purchasing one or more tickets does not guarantee that you will win any prize. Your odds of winning depend on the total number of tickets sold in a given round and other factors outside our control.
- Any promotional mechanics described in the application (such as bonus tickets, multipliers, or free entries) are subject to change or removal at any time and are not a contractual entitlement.
- Prize payouts, if any, are distributed by Megapot according to its own rules and timelines. Delays or failures in that protocol are not attributable to Loofta.
- We reserve the right to modify, suspend, restrict, or discontinue access to Megapot features at any time, including on a jurisdiction-by-jurisdiction basis, without liability to you.
Megapot and other prize-based features may be considered games of chance and may be illegal, restricted, or separately licensed or taxed in certain jurisdictions. You represent that your participation is lawful in your jurisdiction and you assume all legal and financial risk associated with your participation.
9. Mystery Pack
Mystery Pack is a chance-based feature that, in exchange for a fixed USDC payment, allocates you a randomized number of Megapot tickets (as described in Section 8) within a disclosed range. The specific number of tickets you receive is determined at random at the time of purchase and is not known to you in advance.
- Mystery Pack purchases are final and non-refundable once submitted.
- The value of the tickets you receive may be more or less than the amount paid; we do not guarantee any minimum or expected value.
- Available Mystery Pack tiers, pricing, and ticket ranges are subject to change or discontinuation at any time and are disclosed in the application at the time of purchase.
- All disclaimers, risk acknowledgments, and jurisdictional restrictions set out in Section 8 apply equally to Mystery Pack purchases.
10. Giveaways
The Service allows users ("sponsors") to create and fund giveaways that other users may enter, including giveaways tied to engagement with a linked X (Twitter) post. By creating, funding, or entering a giveaway, you agree that:
- Sponsors are solely responsible for funding the giveaway prize, setting eligibility criteria, and complying with any laws applicable to sweepstakes, contests, or promotions in the jurisdictions where the giveaway is offered.
- Loofta acts only as a technical platform that facilitates entry verification and prize distribution; we are not the sponsor of any giveaway unless expressly stated otherwise.
- Winner selection is performed using the mechanism disclosed in the application (which may rely on on-chain randomness or third-party data, such as X API data, to verify entries). We do not guarantee the availability, accuracy, or continued operation of any third-party data source used to verify entries.
- We reserve the right to remove, cancel, or refuse to process any giveaway that we believe, in our sole discretion, violates these Terms, applicable law, or the policies of any third-party platform (including X).
- Loofta is not liable for a sponsor's failure to fund or fulfill a prize, for disputes between sponsors and entrants, or for entries that fail to be recorded due to third-party platform outages or rate limits.
11. Fiat Off-Ramp Services
Where available, the Service allows eligible users to convert USDC into Nigerian Naira (NGN) and withdraw the proceeds to a linked Nigerian bank account through a third-party financial partner. This feature is currently offered on a limited, best-efforts basis and may not be available to all users at all times.
- Fiat off-ramp transactions are subject to the third-party partner's own identity verification (KYC), anti-money-laundering checks, terms of service, and privacy policy, which you must separately accept to use this feature.
- To facilitate a fiat off-ramp transaction, we share your wallet address and transaction details with our third-party partner. The partner may independently collect additional information from you, including bank account details and identity documents, which Loofta does not control.
- Settlement times for bank transfers are determined by our third-party partner and local banking infrastructure and are outside our control. We do not guarantee any particular settlement time.
- Loofta is not a licensed money transmitter, payment service provider, or bank in Nigeria or any other jurisdiction. Regulated fiat payment activity is performed by our third-party partner, not by Loofta.
- We may suspend, limit, or discontinue fiat off-ramp availability at any time, including due to partner outages, regulatory changes, or risk decisions, without liability to you.
12. Compliance Screening
To help prevent the use of the Service for money laundering, sanctions evasion, or other illegal purposes, we use third-party compliance services including Range Protocol to screen wallet addresses involved in transactions, particularly withdrawals.
By using the Service, you consent to the screening of wallet addresses you use in connection with the Service against sanctions lists, risk databases, and other compliance tools. We may, at our sole discretion and without prior notice, decline to process or block transactions involving addresses identified as high-risk or sanctioned.
We comply with applicable anti-money laundering (AML) and know-your-customer (KYC) regulations to the extent required by law. We reserve the right to request additional identity verification information from users if required by applicable law or our compliance obligations.
13. Prohibited Uses
You agree not to use the Service to:
- Violate any applicable law, regulation, or treaty, including anti-money laundering laws, sanctions regulations, and counter-terrorism financing laws.
- Send or receive payments in connection with illegal activity, including fraud, trafficking, or the purchase or sale of illegal goods or services.
- Evade taxes or regulatory obligations.
- Engage in market manipulation, wash trading, or any form of price manipulation.
- Attempt to circumvent our compliance screening or access controls.
- Use the Service in a manner that could disable, overburden, or impair the Service or servers.
- Introduce malicious code, viruses, or other harmful components.
- Reverse engineer, decompile, or disassemble any part of the Service.
- Use automated scripts or bots to access the Service without our express written permission.
- Impersonate any person or entity or misrepresent your affiliation.
Violation of this section may result in immediate account termination, reporting to law enforcement, and/or civil or criminal liability.
14. Rewards Program
Loofta may offer a rewards, loyalty, or referral program from time to time. Rewards are at our sole discretion, have no guaranteed monetary value, and may be modified, suspended, or terminated at any time without notice. Rewards cannot be redeemed for cash unless explicitly stated. We reserve the right to void rewards obtained through abuse, fraud, or violation of these Terms.
15. Third-Party Services
The Service integrates with or relies upon a number of third-party services, including but not limited to:
- Privy, Inc. — identity and embedded wallet management.
- Supabase — database and user data storage.
- Helius — Solana RPC infrastructure.
- Range Protocol — wallet address compliance screening.
- Defuse Protocol / Near Intents — cross-chain deposit and withdrawal routing.
- MagicBlock — ephemeral rollup infrastructure used for private and accelerated on-chain transactions.
- PAJ Cash — third-party fiat off-ramp partner for Nigerian Naira withdrawals.
- Vercel — frontend hosting and analytics.
- Cloudflare — bot protection and security (Turnstile).
- X (Twitter) — optional social login, giveaway entry verification, and integrations.
Your use of any third-party service is governed by that service's own terms and privacy policy. We are not responsible for the actions, data practices, or availability of any third-party service. The inclusion of third-party integrations does not constitute an endorsement of those services.
16. Intellectual Property
All content, branding, software, and technology comprising the Service — including but not limited to the Loofta name, logo, interface design, and source code — is the exclusive property of Loofta or its licensors and is protected by copyright, trademark, and other intellectual property laws.
We grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service solely for its intended purpose. You may not copy, modify, distribute, sell, or otherwise exploit any part of the Service without our express written permission.
17. Disclaimers
No financial advice. Nothing on the Service constitutes financial, investment, legal, or tax advice. Cryptocurrency values are volatile and you may lose money. You are solely responsible for your own financial decisions.
Assumption of risk for chance-based features. Participation in Megapot, Mystery Pack, and giveaway features described in Sections 8 through 10 is entirely at your own risk. We make no representation or warranty, express or implied, that you will win any prize, that any drawing will occur on a particular schedule, or that any third-party protocol, sponsor, or data source involved in those features will perform as expected. You assume full responsibility for any financial loss arising from your decision to participate.
As-is basis. The Service is provided "as is" and "as available" without warranty of any kind, whether express, implied, or statutory. We disclaim all warranties, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.
We do not warrant that the Service will be uninterrupted, error-free, secure, or that defects will be corrected. Blockchain networks are inherently outside our control and we are not responsible for network congestion, forks, outages, or smart contract vulnerabilities.
Some jurisdictions do not allow the exclusion of implied warranties, so some of the above may not apply to you.
18. Limitation of Liability
To the maximum extent permitted by applicable law, Loofta and its officers, directors, employees, agents, and licensors shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, including loss of profits, data, goodwill, funds, or other intangible losses, arising from or relating to your use of or inability to use the Service.
Without limiting the foregoing, and to the maximum extent permitted by applicable law, we shall not be liable for any losses arising from or relating to: (a) your participation in, or failure to win a prize through, Megapot, Mystery Pack, or giveaway features; (b) the acts, omissions, insolvency, or unavailability of any third-party protocol, sponsor, or fiat off-ramp partner referenced in these Terms; or (c) delays, failures, or errors in any third-party service we integrate with but do not control.
Our total cumulative liability to you for any claims arising out of or relating to the Service shall not exceed the greater of (a) the total platform fees paid by you to Loofta in the twelve (12) months preceding the claim, or (b) USD $100.
These limitations apply regardless of the legal theory on which the claim is based and even if we have been advised of the possibility of such damages. Some jurisdictions do not allow certain limitations of liability, so some of the above may not apply to you.
19. Indemnification
You agree to defend, indemnify, and hold harmless Loofta and its affiliates, officers, directors, employees, and agents from and against any claims, damages, obligations, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from: (a) your use of the Service; (b) your violation of these Terms; (c) your violation of any third-party rights; or (d) any claim that content you submitted caused damage to a third party.
Release. To the maximum extent permitted by law, you release Loofta Inc. from all claims, demands and damages, known or unknown, arising out of or relating to your use of the Service or any dispute with another user or third party. If you are a California resident, you waive California Civil Code Section 1542, which says: "A general release does not extend to claims that the creditor or releasing party does not know or suspect to exist in his or her favor at the time of executing the release and that, if known by him or her, would have materially affected his or her settlement with the debtor or released party."
No fiduciary duty or registration. Loofta Inc. is not a bank, broker-dealer, exchange or investment adviser, and is not registered with the U.S. Securities and Exchange Commission. We owe you no fiduciary duties, we do not guarantee best execution, and you are solely responsible for safeguarding your wallet keys and recovery phrases. Blockchain transactions are irreversible.
20. Termination
You may stop using the Service at any time. We may suspend or terminate your access to the Service at any time, with or without cause, with or without notice, effective immediately.
Upon termination, your right to use the Service ceases immediately. Sections 5, 8, 9, 10, 11, 13, 16, 17, 18, 19, and 21 of these Terms survive termination. Because the Service is non-custodial, termination of your account does not affect your ability to access funds in your own wallet directly on-chain.
21. Governing Law
These Terms are governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to conflict of law principles. Any dispute arising from these Terms or the Service shall be resolved exclusively in the state or federal courts located in Delaware, and you consent to personal jurisdiction in those courts.
Informal resolution. Before filing any formal claim, you agree to try to resolve the dispute informally by contacting us at hello@loofta.xyz. We will try to resolve the dispute informally within 30 days.
22. Changes to These Terms
We may update these Terms from time to time. When we make material changes, we will update the effective date at the top of this page and, where required by applicable law, notify you through the application or by email. Your continued use of the Service after any such changes constitutes your acceptance of the new Terms.
23. Contact
If you have any questions about these Terms, please contact us at:
Loofta Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, USA
Email: hello@loofta.xyz
Support: hello@loofta.xyz
Website: loofta.com
Legal
Privacy Policy
Effective date: August 10, 2026
1. Overview
Loofta Pay is a non-custodial Solana-based payment platform. Authentication is handled by Privy, Inc.; transaction data and user profiles are stored in our own database (Supabase); and certain features rely on third-party services described in Section 4. This policy applies to the Loofta Pay web application and all associated services.
2. Information We Collect
a) Information you provide directly
- Email address — when you sign up or log in using email-based authentication via Privy.
- X (Twitter) account details — if you choose to log in using your X account via Privy (username and profile identifier).
- Username — if you set a custom Loofta username in settings.
- Wallet addresses — Solana wallet addresses associated with your account, including addresses of embedded wallets created by Privy on your behalf.
b) Information generated by your use of the Service
- Transaction records — sender/recipient identifiers, amount, timestamp, transaction hash, and status for all payments you send or receive through the Service.
- Payment links — metadata associated with payment links you create, including any message or emoji attached.
- Deposit and withdrawal records — including third-party protocol identifiers and transaction hashes.
- Megapot, Mystery Pack, and giveaway activity — ticket purchase records, purchase amount, associated wallet address, giveaway entries you submit or create, and draw or winner results. See Section 5 for details.
- Fiat off-ramp activity — if you use the Naira withdrawal feature, we record the withdrawal amount, wallet address used, and transaction status. See Section 6 for details.
- Rewards and referral activity.
c) Technical information collected automatically
- Browser and device type, operating system, and language preference.
- IP address and approximate geographic location (country/region level).
- Pages visited, features used, and interaction events — collected via Vercel Analytics in an aggregated, privacy-preserving manner.
- Cloudflare Turnstile signals — behavioral signals used to distinguish human users from bots. No personal data is sold or shared from this process.
d) Information from third parties
- Privy user identifier — a unique identifier assigned by Privy that we use to link your identity to your Loofta account.
- Compliance signals — wallet address risk signals from Range Protocol used to screen withdrawal addresses.
- X (Twitter) engagement data — for giveaways tied to a linked X post, we retrieve public engagement data (e.g., quote-tweet author identifiers) from the X API to verify entry eligibility. This data is cached for a short period (up to 60 seconds) to limit repeated API calls.
- Fiat off-ramp verification signals — if you use the Naira withdrawal feature, our third-party partner PAJ Cash may independently verify your identity and share limited status information (e.g., verification or transaction status) back to us.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your Loofta account.
- Authenticate you via Privy when you log in.
- Process, record, and display payment transactions you initiate or receive.
- Enable you to find other users by email or username to send payments.
- Process Megapot, Mystery Pack, and giveaway participation, including verifying giveaway entries and recording draw results.
- Facilitate fiat off-ramp transactions by sharing necessary wallet and transaction details with our third-party partner.
- Screen wallet addresses against sanctions lists and risk databases as required by law.
- Provide customer support and respond to your inquiries.
- Detect and prevent fraud, abuse, and unauthorized use of the Service.
- Send transactional notifications related to your account or payments (we do not send marketing emails without your consent).
- Analyze aggregated, anonymized usage patterns to improve the Service.
- Comply with applicable legal obligations.
4. Third-Party Services
We share limited data with the following third-party service providers, strictly to the extent necessary to operate the Service:
| Third Party | Purpose |
|---|---|
| Privy, Inc. | Identity management and embedded Solana wallet creation. Privy stores your email or social login credentials and manages your embedded wallet keys. See Privy's Privacy Policy at privy.io. |
| Supabase | Database storage for user profiles, payment history, and app state. Data is stored in a managed PostgreSQL instance. |
| Vercel | Frontend hosting (pay.loofta.com) and privacy-preserving usage analytics. Vercel Analytics does not use cookies or fingerprinting. |
| Railway | Backend hosting and server-side processing. |
| Helius | Solana RPC infrastructure. Transaction data is broadcast to the Solana network via Helius. |
| Range Protocol | Wallet address compliance and sanctions screening for withdrawals. |
| Defuse Protocol / Near Intents | Cross-chain deposit and withdrawal routing. Your wallet address and intended transaction are shared to facilitate cross-chain operations. |
| MagicBlock | Ephemeral rollup infrastructure used to process private and accelerated on-chain transactions. |
| PAJ Cash | Third-party fiat off-ramp partner. Processes Naira withdrawals and independently collects identity verification (KYC) and bank account information directly from you. |
| Cloudflare | Bot and spam protection (Turnstile). Cloudflare may process IP address and behavioral signals. |
| X (Twitter) | Optional social login and giveaway entry verification. If you log in with X, or enter an X-linked giveaway, Privy or our giveaway feature processes your public X account identifier and engagement data. |
We do not sell your personal information to any third party. We do not share your data with advertisers. We may disclose information to law enforcement or regulators if required by applicable law, court order, or to protect the safety of users or the public.
5. Megapot, Mystery Pack & Giveaway Data
When you purchase Megapot tickets, purchase a Mystery Pack, or create or enter a giveaway, we collect and store records of that activity, including the wallet address used, amount paid, ticket count, entry timestamp, and (where applicable) draw or winner results. This data is used to operate the feature, display your activity history to you, and detect abuse.
For giveaways tied to a linked X (Twitter) post, we process public X data (such as the identifier of an account that quote-tweets the linked post) solely to verify entry eligibility, as described in Section 2(d). We do not access private X account data, and we do not use this data for advertising.
Because Megapot, Mystery Pack, and giveaway transactions are recorded on the Solana blockchain, the wallet-level activity associated with these features is subject to the public-ledger considerations described in Section 7.
6. Fiat Off-Ramp Data (Naira)
If you use the Naira fiat off-ramp feature, we share your wallet address and the relevant transaction details (amount, timestamp, status) with our third-party partner, PAJ Cash, to facilitate the conversion and bank transfer.
PAJ Cash independently collects and processes additional information directly from you to complete the off-ramp, including bank account details and identity verification (KYC) documentation. That information is collected and controlled by PAJ Cash under its own privacy policy, not by Loofta. We do not store your bank account number or KYC documents ourselves; we retain only the wallet address, amount, and status of the associated transaction.
7. Blockchain & Public Data
All transactions processed through the Service are recorded on the Solana blockchain, which is a public, immutable ledger. This means:
- Transaction details including wallet addresses, amounts, and timestamps are permanently and publicly visible to anyone who queries the Solana blockchain.
- We cannot delete, modify, or obscure blockchain records.
- Payment links contain a short identifier that may be shared publicly; the link itself reveals only the payee's identifier and requested amount, not their full wallet address unless the payer views the chain.
You should be aware of the public nature of blockchain transactions before using the Service. Our non-custodial architecture means your wallet address is the primary identifier for your funds on-chain.
8. Information Sharing
We may share your information in the following circumstances:
- With service providers listed in Section 4 as necessary to operate the Service.
- With other users to the minimum extent required to complete a transaction (e.g., a payer can see that their payment was sent to your username or wallet address).
- In connection with a merger, acquisition, or sale of all or a portion of our assets — in which case your information would be subject to the acquirer's privacy policy.
- If required by law, regulation, legal process, or governmental request.
- To protect the rights, property, or safety of Loofta, our users, or the public.
9. Data Retention
We retain your account information and transaction history for as long as your account is active, plus a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements.
If you request deletion of your account, we will delete or anonymize your personal information within 30 days, subject to our obligation to retain certain records under applicable law (e.g., AML regulations may require us to retain transaction, Megapot, giveaway, and fiat off-ramp records for up to 5 years).
Blockchain transaction data is permanent and cannot be deleted, as described in Section 7.
10. Security
We implement industry-standard technical and organizational security measures to protect your information, including:
- Encryption of sensitive keys at rest using Google Cloud KMS (Key Management Service).
- HTTPS encryption for all data in transit.
- Access controls limiting internal access to personal data.
- Supabase row-level security policies to ensure users can only access their own data.
- Cloudflare Turnstile to prevent bot abuse and unauthorized automated access.
No security system is impenetrable. We cannot guarantee the security of your information, and you use the Service at your own risk. You are responsible for securing your own wallet credentials and login methods.
12. Your Rights (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) or equivalent laws:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure — request deletion of your personal data, subject to legal retention obligations.
- Right to restriction — request that we restrict processing of your data in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on your consent, withdraw it at any time.
To exercise any of these rights, email us at hello@loofta.xyz. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
Our legal bases for processing include: performance of a contract (operating the Service for you), compliance with legal obligations, and our legitimate interests in fraud prevention and service improvement.
13. Your Rights (CCPA / California)
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:
- Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you.
- Right to delete — request deletion of your personal information, subject to certain exceptions.
- Right to opt out of sale — we do not sell your personal information.
- Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.
To make a CCPA request, contact us at hello@loofta.xyz. We will verify your identity before processing the request.
14. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child under 18, please contact us immediately at hello@loofta.xyz and we will delete such information promptly.
15. International Data Transfers
Loofta operates globally and your information may be transferred to, stored in, and processed in the United States and other countries where our service providers maintain infrastructure. By using the Service, you consent to such transfers.
Where we transfer personal data from the EEA or UK to countries not deemed to provide an adequate level of data protection, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum.
16. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and, where required, notify you through the application or by email. We encourage you to review this policy periodically.
17. Contact
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Loofta Inc. — Privacy
131 Continental Dr, Suite 305
Newark, DE 19713, USA
Email: hello@loofta.xyz
Website: loofta.com