Wish list Sustainability check How it works Help centre Sign up Log inList a toy

Legal

Privacy Policy

Last updated: October 2026

Quick note from us

This document explains what data we collect, why we collect it, and what you can do about it. Each section opens with a plain-language summary so children and parents can both follow along. The full text underneath is the legally binding version.

If anything is unclear, write to us at support@loopyty.com. Our Terms explain the rules of using Loopyty. This document is only about data.

1. Who's in charge of your data

Loopyty AS is the "data controller" — that's the legal word for "the company responsible for what happens to your data."

Loopyty AS
Norwegian organisation number: 933 519 708
Parkveien 15C, 0350 Oslo
Email for privacy questions: support@loopyty.com

We follow the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

2. What we collect, why, and on what legal basis

We only collect what we need. Here's the full list — what, why, and the legal reason we're allowed to.

What we collect

Why

Legal basis (GDPR)

Account info: name, username, email, phone, birthday, address

To create your account, verify you're a real person, and let us contact you

Contract (Art. 6(1)(b))

Family info: children's first names, ages, interests

To personalise the experience and help the account holder manage things together

Consent (Art. 6(1)(a)) — or, once you have a toy store subscription, Contract (Art. 6(1)(b)), because the children's sub-accounts are part of what you buy

Children's sub-accounts: the avatar the child designs, a PIN (stored only as a scrambled hash, never readable), the stores they open, their goals and wish lists, and a login cookie on the device

So a child can use their own stores safely, with the account holder in charge

Contract (Art. 6(1)(b))

Listings, photos, and reviews you post

To show your toys on the platform so others can buy them

Contract (Art. 6(1)(b))

Toy photos read by AI: the photos you upload when listing

So we can suggest the title, category and details — the suggestion is only a suggestion, you decide what is listed

Legitimate interest (Art. 6(1)(f))

Payment & payout info (handled by Stripe — we only see the basics)

To take payments, send payouts, and prevent fraud

Contract + Legal obligation (Art. 6(1)(b) and (c))

Subscription: the size you chose, when it renews, and your receipts (card details stay with Stripe)

To run the subscription and keep the books

Contract + Legal obligation (Art. 6(1)(b) and (c))

Groups: the groups you create or join, who is in them, and what the group sees

So a group can see each other's toys and meet

Contract (Art. 6(1)(b))

Meeting in person: the times and place you propose, and a handover code

To arrange the handover and charge the buyer when it happens

Contract (Art. 6(1)(b))

Identity verification (KYC) info for sellers

Required by anti-money-laundering law before Stripe can pay you out

Legal obligation (Art. 6(1)(c))

Sales records (who sold what to whom, when, for how much)

Bookkeeping, tax reporting, and dispute handling

Legal obligation (Art. 6(1)(c)) — Norwegian Bookkeeping Act § 13, EU DAC7

How you use Loopyty: pages visited, clicks, device type, approximate location

To make Loopyty work, improve it, and keep it safe

Legitimate interest (Art. 6(1)(f)) for basic functionality and security; consent for analytics & marketing cookies (Art. 6(1)(a))

Messages to support, reports you submit

To help you and to investigate issues

Contract + Legitimate interest

Marketing emails

To tell you about new features and tips

Consent — you can unsubscribe any time using the link in every email

If we ever want to use your data for something not on this list, we'll ask you first.

3. Who we share data with

We don't sell your data. We share it only with companies that help us run Loopyty, and only for that purpose.

We share data with:

Stripe — handles payments and payouts. Stripe is the controller of payment data it collects directly.
Google Cloud Platform — hosts the platform and stores data securely.
Google (Vertex AI) — reads the photos of a toy you are listing, to suggest what it is. The photos are used for that answer, not to train Google's models.
Elastic — runs our search, and holds the listings so they can be found. The search index is in the EU (Belgium).
Postmark — sends our emails (receipts, order emails, notices).
Shipping partners — currently Helthjem. When you sell, we share the seller's pickup address; when you buy, we share the buyer's name and delivery address. The shipping partner uses this only to collect and deliver the parcel and acts as a separate controller from that point.
Google Analytics (Google) — measures how the site is used, only if you've accepted analytics cookies.
PostHog (EU-hosted) — product analytics and session replay to understand and improve the experience; data is stored in the EU and we only set these if you've accepted analytics cookies.
Heyo — runs the live chat on our landing page, "How it works" and Help centre. It only receives what you choose to type into the chat; we don't pass it your account details. The chat only loads if you've accepted cookies.

These partners are data processors. They follow our instructions and have signed data processing agreements with us as required by GDPR Article 28.

Inside Loopyty, we also share:

With other members of your groups — your first name, and the toys your family lists. On Friends and family the account holder's full name is shown, so people can tell two people with the same first name apart.
With the other person in a meeting — the times and place you propose, and your first name.

We may also share data with:

Tax authorities, where required by law (for example, under DAC7 if your sales pass certain thresholds — we'll tell you what we report).
Police or public authorities, where we're legally obliged to.
A buyer in a transaction — they need the relevant address and shipping info to complete the sale.
A future buyer of Loopyty AS, if the company is sold or merged — your data would transfer with it under the same protections.

We do not sell your data to advertisers.

4. Where your data goes (international transfers)

Some of our partners are based outside Europe. When data leaves the EU/EEA, we make sure it's still protected.

Stripe, Google (including Vertex AI, which reads toy photos) and Postmark may process some data in the United States or other countries outside the EU/EEA. Elastic keeps our search index in the EU, but its staff and sub-processors may have limited access from outside it. Heyo, our live-chat provider, keeps chat data in the EU. When data does leave the EU/EEA, we rely on one of the legal mechanisms GDPR allows:

the EU–US Data Privacy Framework (where the partner is certified), or
EU Standard Contractual Clauses (SCCs) plus extra safeguards where needed.

You can ask us for a copy of the safeguards by emailing support@loopyty.com.

5. How long do we keep data

Only as long as we need to. Some things we have to keep for tax law; the rest we delete when you do.

Type of data

How long

Account info

While your account is open, then deleted within 90 days of closure (unless we need to keep something for the reasons below)

Children's sub-accounts and stores

While the subscription and the account are open; deleted with the account, or when the account holder removes the child

Sales and payment records

5 years after the transaction (Norwegian Bookkeeping Act § 13)

Subscription receipts

5 years (Norwegian Bookkeeping Act § 13)

Meeting times, places and handover codes

With the order, as sales records

KYC/identity verification

5 years after the business relationship ends (anti-money-laundering law)

Messages and support tickets

Up to 3 years, then deleted

Marketing data (if you've consented)

Until you unsubscribe or close your account

See section 9

Data needed for an ongoing dispute or legal claim

Until the matter is resolved

When data is no longer needed, we delete it or anonymise it (so it can't be linked back to you).

6. Your rights

You're in charge of your data. Here's everything you can ask us to do.

Under GDPR, you have the right to:

Access — get a copy of the data we hold about you.
Rectification — correct anything that's wrong or out of date.
Erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention rules.
Restriction — ask us to pause processing while we sort something out.
Portability — get your data in a common machine-readable format, or have it sent to another service.
Object — tell us to stop processing data we use under "legitimate interest," including for marketing.
Withdraw consent — at any time, where we rely on consent (this won't undo what we did before withdrawal).
Not be subject to automated decisions that have a legal or similarly significant effect on you. We don't currently make decisions like that, but we'll tell you if that ever changes.

To use any of these rights, email support@loopyty.com. We'll respond within 30 days (sometimes sooner). We may ask you to confirm your identity first, so no one else can pretend to be you.

If you think we're handling your data wrongly, you can complain to Datatilsynet (the Norwegian Data Protection Authority) at datatilsynet.no, or to the data protection authority where you live.

7. Children on Loopyty

The account belongs to a parent or guardian. With a subscription, children get their own login — and we treat their data with extra care.

Accounts are for parents and guardians. You must be 18 or older to open and run a Loopyty account. The account holder is responsible for the children using it.

Children's sub-accounts. With a toy store subscription, the account holder can give each child a sub-account with their own login. That means we process, for each child:

their first name, age and interests — to show toys that fit,
the avatar they design and a PIN (stored only as a scrambled hash we cannot read),
the stores they open, the toys they list, their goals and their wish list,
a login cookie on the device, so they stay signed in.

What we never do with children's data. We show a child by first name only, everywhere. We never show a child's surname, address or phone number. We don't share children's information with advertisers, we don't build advertising profiles on children, and children never pay for anything or receive payouts — money always goes through the account holder.

Photos. Please don't upload photos that show identifiable children's faces. A child's hand holding a toy is fine; a clear face shot is not. A child's avatar is a design they make, never a photo.

Article 8 GDPR. Norway sets the age at which a child can consent to digital services at 13. Children on Loopyty always use it under a parent's or guardian's account, and the account holder agrees on their behalf. If we discover an account used by someone under 18 without an account holder, we suspend it and contact the parent or guardian.

Removing a child. Email support@loopyty.com and we delete that child's data — except sales records we must keep by law (section 5).

8. How we keep data safe

We use industry-standard security measures. Stripe and Google handle the most sensitive parts.

On our side:

Encrypted connections (HTTPS) for everything you do on Loopyty.
Access controls — only team members who need to see the data can view it.
Regular review of who has access to what.
Backups and recovery plans.

Payments — Stripe. Card numbers and bank details are stored by Stripe, not by us. Stripe is certified to PCI Service Provider Level 1, the highest standard in the payments industry. Card numbers are encrypted with AES-256, and Loopyty never sees your full card number.

Hosting — Google Cloud Platform. GCP is one of the most secure cloud platforms available.

If something goes wrong. If there's a data breach likely to put you at risk, we'll notify Datatilsynet within 72 hours and notify you directly without undue delay, as the GDPR requires.

9. Cookies and similar technologies

Some cookies are necessary for Loopyty to work. Others are optional and only run if you say yes.

Necessary cookies keep you logged in, remember your settings, and keep the platform secure. We use these without asking — we have to, for the platform to work.

Children's login. When a child signs in with their PIN, we set a necessary cookie on that device so they stay signed in. It holds no name or PIN — only a session we can check.

Optional cookies help us understand how Loopyty is used so we can improve it. We use Google Analytics and PostHog for this, and we only set these cookies if you've accepted them in our cookie banner. You can change your mind at any time using the “Cookie settings” link in the footer, or by clearing your browser cookies.

Session replay. With your consent, PostHog also records on-screen interactions (clicks, scrolling, navigation) so we can spot problems and improve the experience. Sensitive content — names, addresses, email and payment details — is masked and never recorded, and this data is stored in the EU.

Live chat. With your consent, our chat provider Heyo sets a cookie so a conversation stays with you as you move between pages. The chat doesn't load at all until you've accepted cookies, and it only ever receives what you type into it.

Retention. Most cookies expire within 24 months. Session cookies disappear when you close the browser.

We follow the EU ePrivacy Directive and Norwegian electronic communications law (Ekomloven) on cookies and tracking.

10. Changes to this Privacy Policy

If we change something important, we'll tell you.

We may update this policy from time to time. If a change meaningfully affects your rights or how we use your data, we'll let you know by email or in the app at least 30 days before it takes effect. Smaller wording changes will just be posted here with a new “last updated” date.

11. Contact us

Questions about your data? Want to use one of your rights? Write to us.

Loopyty AS
Org. no. 933 519 708
Parkveien 15C, 0350 Oslo
Email: support@loopyty.com

For complaints you'd rather take to a regulator: Datatilsynet — datatilsynet.no.

Thanks for trusting us with your data. We'll look after it.