This Privacy Policy explains how QuestLoot LLC, a Wisconsin limited liability company (“QuestLoot,” “we,” “us,” or “our”), collects, uses, shares, and protects information when you use our website and services (the “Service”). It should be read together with our Terms & Conditions.
1. Scope of This Policy
This Policy covers information collected through the QuestLoot website and account services. It does not cover the practices of the independent offer providers whose quests you complete, or of our payments partner once your reward is issued to you — each has its own privacy policy that governs its handling of your information, and we encourage you to review them.
2. Information We Collect
We collect:
- Account information: your name, email address, and password (stored only as a salted hash, never in plain text).
- Security information: if you enable them, two-factor authentication secrets and passkey credentials, stored encrypted.
- Technical information: your IP address, device/browser information (including your browser’s user-agent details such as device type and operating-system version), and session/cookie identifiers, collected automatically when you use the Service.
- Device fingerprint information: when you register, we and our fraud-prevention vendor (FingerprintJS) collect technical signals about your browser and device (resulting in a device identifier, sometimes called a “visitor ID”) used to detect accounts registered from the same device.
- Identity verification information: before your first cashout, our identity-verification vendor (Didit) may collect a government-issued ID you submit and a live selfie/liveness check, and derives the verification result (approved, declined, etc.) that we receive. We receive that result and Didit's own session identifier, not a copy of your ID image or biometric data, which Didit processes and retains under its own privacy policy as our service provider.
- Activity & balance information: the quests you start, the offer completions and reversals reported to us by offer providers (including transaction IDs and amounts), your account balance, the bonus codes you redeem, and your cashout history.
- Cashout/reward information: when you request a cashout, the email address used to deliver your reward is shared with our payments partner as described in Section 4. For a cryptocurrency cashout, we additionally collect and store the wallet address, Lightning address, or Lightning invoice you provide as the payout destination, and the resulting transaction reference once sent.
- Referral information: if you accept our Referral Terms, a permanent referral code tied to your account; if you register through someone else's referral link, that link between your account and theirs. Someone who referred you can see your first name, last initial, signup date, and progress toward unlocking their referral bonus — not your email or full name.
- Survey profile information: if you choose to provide it, any of the following: your date of birth, gender, country, and ZIP/postal code and, as survey networks begin to use them, your employment status, industry, and role in your organization. We use it only to match you with better-targeted surveys. Every field is optional and nothing here is required to use the Service. We share an answer with a survey network only after you explicitly consent to sharing it, as described in Section 4. You can view, change, or delete these answers, and withdraw your consent, at any time in Settings → My Data (Section 8). If a survey network later starts to use a new kind of information, we will ask you about it separately and will not use or share it unless you agree.
- Task submissions: if you create or complete a task, what you write and the images you upload as proof. They are shown to the person who posted the task and, if a decision is disputed, to our staff.
- Communications: information you provide when you contact support.
3. How We Use Information
- To create and administer your account and provide the Service, including tracking quest progress and crediting your balance;
- To process cashout requests and deliver rewards, either through our payments partner or, for a cryptocurrency cashout, by sending it directly to your provided wallet address ourselves;
- To detect, investigate, and prevent fraud, abuse, and violations of our Terms, including verifying an offer provider’s postback IP allow-list and postback signatures;
- To communicate with you about your account, transactions, and (where you have not opted out) product updates;
- To maintain the security, integrity, and performance of the Service, including finding and fixing errors and slow pages; and
- To comply with legal obligations.
6. Data Retention
We retain account and transaction information for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, fraud-prevention, and dispute-resolution obligations. When you request deletion under Section 8, we delete or anonymize your personal information except where we are required or permitted to retain it (for example, transaction records needed to resolve a payout dispute). Survey profile answers (Section 2) are kept only until you change or delete them, withdraw your consent in Settings → My Data, or delete your account. We keep the date you last consented and, if you withdrew, the date you did so, so we can show we honored your choices; we do not keep your answers once you have deleted them.
7. Data Security
We use industry-standard safeguards, including encryption in transit, hashed passwords, and encrypted storage of two-factor and passkey credentials, and signature verification and IP allow-listing on offer-provider postbacks. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your Rights & Choices
Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, to object to or restrict certain processing, or to receive a copy of your data in a portable format. You can update your name, email, and security settings directly from your account. You can also view, change, or delete the optional survey profile information you have provided, and withdraw your consent to share it, at any time in Settings → My Data without contacting us. To exercise any other right, contact us at support@questloot.io to exercise any of these rights. We will respond within the time required by applicable law and may need to verify your identity before acting on a request. Because Didit, not us, holds any government ID image and selfie/liveness data submitted during identity verification (Section 2), a request to access or delete that specific data should also be directed to Didit under its own privacy policy.
9. Children’s Privacy
The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a user under 18, we will delete it and terminate the associated account.
10. International Users
QuestLoot operates from and processes data in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have data protection laws different from those of your country.
11. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
12. Contact Us
QuestLoot LLC is a Wisconsin limited liability company. Questions about this Policy or requests regarding your personal information can be sent to support@questloot.io.
QuestLoot LLC
415 5th Ave S
Strum, WI 54770