Privacy Policy

1. Who we are

This policy covers lootmogul.com and the Services described in our Terms. The controller of your personal data is NextGenTM, Inc., a Delaware corporation doing business as LootMogul, 831 N Tatnall Street, Suite M #275, Wilmington, DE 19801, United States. Contact: privacy@nextgentm.com.

When a Business Customer (for example a team or league) uses the Services to process its own people's data under a data processing agreement, that customer is the controller and we act as its processor for that data. Questions about that data should go to the customer; we will pass on requests we receive.

2. Personal data we collect

• Account and contact data: name, email address, profile photo, role and organization, and the 18+/Terms confirmation with its date and version.
• Sign-in data: if you sign in with Google or Facebook, the basic profile those providers share (name, email, profile picture, and an account identifier). We do not receive your passwords.
• Enquiries and applications: what you send through contact, application and newsletter forms, including your business details and message.
• User Content: prompts, uploads, documents, images, video and messages you submit, and Output generated for you, including conversation history kept so that conversations stay coherent.
• Voice and likeness data: for people who license their identity, voice recordings, photos, video and derived voice or avatar models. Our Biometric, Voice & Likeness Notice explains this in detail.
• Purchase data: what you bought, amount, currency, country, Gem balance and transactions, and the confirmation you gave before checkout. Card and bank details are entered with our payment providers; we receive only limited details such as the status, last digits and card brand.
• Connected social account data: if you connect a social account for publishing, the account name and identifiers, the authorization needed to post on your behalf, and the posts and media you schedule.
• Device and usage data: IP address, browser, device and operating system, pages visited, referring site, approximate location derived from IP, and, only with your permission, clicks and feature-use events.
• Security data: sign-in records, abuse-prevention signals (including Google reCAPTCHA on some forms) and audit logs.

3. Where it comes from

From you; from your device and browser; from sign-in, payment and social providers when you use them; from Business Customers who add their people; and, for research on athletes and public figures that partners request, from publicly available sources.

4. Why we use it and our legal bases

If UK or EU data protection law applies to you, we rely on the following legal bases. Other countries' rules are covered in sections 11 to 14.

• Providing your account and the Services you request, processing purchases and supporting you — performance of a contract.
• Creating and operating a Licensed AI Identity from voice or likeness data — the person's explicit consent, which can be withdrawn at any time.
• Optional analytics, optional functional features and marketing measurement — consent, given through our cookie settings.
• Marketing emails such as the Intelligence Brief — consent, or where the law allows, our legitimate interest in contacting existing business contacts about similar services. You can unsubscribe at any time.
• Keeping the Services secure, preventing fraud and abuse, and improving reliability — our legitimate interests in running a safe service. You can object (see section 10).
• Responding to business enquiries and partner research — our legitimate interests in developing our business, balanced against your rights.
• Tax, accounting, responding to lawful requests and enforcing our rights — legal obligation, or legitimate interests where no specific obligation applies.

5. AI features

When you use an AI feature, your prompt and any content you attach are sent to an AI model provider to generate a response, image, voice or video. Output and, where a feature remembers context, conversation history are stored with your account. Licensed AI Identities draw on the voice, likeness and knowledge materials the rights holder supplied. We do not use your content, voice or likeness to train general-purpose AI models.

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. If that changes for any feature, we will tell you and offer human review where the law requires.

6. Who receives personal data

We share personal data only as needed for the purposes above, with:

• Hosting, database and storage: Lovable Cloud and its infrastructure providers.
• AI model and voice providers: the Lovable AI Gateway, Google (Gemini) and OpenAI for text, image and video generation; ElevenLabs and Fish Audio for speech and licensed voices.
• Payments: Stripe for card and related payments, and MoonPay where you choose to pay with crypto.
• Sign-in: Google and Meta (Facebook) when you choose to sign in with them.
• Social publishing: PostProxy and Upload-Post, which deliver posts to the social networks you connect.
• Research and security: Firecrawl for public web research that partners request, and Google reCAPTCHA for form protection.
• Email delivery: our email delivery provider for account and newsletter emails.
• Measurement: Google Analytics and our own analytics only where enabled and only with your permission.
• Hosting measurement: Lovable, which provides our basic visit measurement and, with your Analytics consent, click measurement (see Cookies, section 16).
• Others: professional advisers; authorities where the law requires; and a buyer or successor if our business is reorganized, subject to this policy.

We engage service providers to process data for us under their service terms, which restrict how they may use it. Some, such as payment providers, sign-in providers and social networks, also act as independent controllers under their own privacy policies, and some provider terms allow limited use for their own purposes such as security and service improvement.

We do not sell personal data, and we do not share it for cross-context behavioural or targeted advertising.

7. International transfers

We are based in the United States, and our providers may process data in the United States and other countries. The main destination country is the United States; some providers also use other countries listed in their own terms. When UK, EU, Swiss or other law restricts transfers, we use an adequacy decision where one applies, or the transfer mechanisms that our providers make available in their data processing terms, such as the European Commission's Standard Contractual Clauses or the UK Addendum, where they apply to that provider. For South Africa, we transfer data only where section 72 of POPIA allows. Email privacy@nextgentm.com to ask which countries and safeguards apply to a particular provider.

8. How long we keep it

• Account data and User Content: while your account is open; after you ask us to delete it, removed from active systems as part of handling your request, except where the law requires us to keep it.
• Voice and likeness data: while the license and consent are in force; destroyed when consent is withdrawn, and in any case when the purpose of collection has been fulfilled or three years after the person's last interaction with us, whichever comes first.
• Purchase and tax records: for as long as tax and accounting law requires.
• Enquiries and business contacts: while the conversation or relationship is active and for a reasonable period afterwards to follow up and keep records.
• Security logs: for as long as reasonably needed to investigate and prevent abuse.
• Hosting visit measurement: kept by Lovable, detailed data for 90 days and daily summaries for one year.

Copies in backups are deleted as the backups are replaced on their normal cycle. Providers that act as independent controllers keep data under their own policies.

9. Security

We use access controls, encryption in transit, role-based permissions and monitoring to protect personal data. No system is completely secure; we will notify you and authorities of a breach where the law requires.

10. Your rights

Depending on where you live, you may have the right to: access your data; correct it; delete it; receive it in a portable format; restrict or object to processing, including an unconditional right to object to direct marketing and a right to object to processing based on legitimate interests; withdraw consent at any time (this does not affect earlier lawful processing); and appeal our decision. We will not treat you less favourably for exercising your rights.

How to make a request. Use our Privacy Rights Request page or email privacy@nextgentm.com. We will ask for information proportionate to the request to confirm who you are — usually confirming control of the email on the account. An authorized agent may act for you with written permission; we may confirm the request with you. Opting out of sale, sharing or targeted advertising, or sending a Global Privacy Control signal, never requires you to sign in or prove your identity. See Your Privacy Choices.

11. UK and EEA residents

We respond within one calendar month. Where a request is complex or there are many requests, we may extend this by up to two further months and will tell you why within the first month. You can complain to your data protection authority — in the UK the Information Commissioner's Office, and in the EEA your national authority listed by the European Data Protection Board. Nothing in our Terms removes your data protection rights.

11a. Switzerland

Under the Swiss Federal Act on Data Protection (FADP) you may ask whether we process your personal data and for a copy, ask us to correct it, object to processing, ask us to stop disclosing it, receive data you gave us in a portable format, and ask for a human to review an automated individual decision. We generally provide access free of charge within 30 days; if we need longer we will tell you why and when to expect our answer. Email privacy@nextgentm.com. You can contact the Federal Data Protection and Information Commissioner (FDPIC).

12. United States residents

Residents of California and other states with comprehensive privacy laws have the rights described in section 10 as those laws provide, including the right to know the categories and specific pieces of personal data we hold, and to limit use of sensitive personal information. In the last 12 months we collected the categories listed in section 2 (identifiers, commercial information, internet activity, approximate geolocation, audio and visual information including voice and likeness, professional information, and inferences limited to feature personalization), from the sources in section 3, for the purposes in section 4, and disclosed them for business purposes to the recipients in section 6. Sensitive personal information (account sign-in data, and voice or likeness data where it is used to identify a person) is used only to provide the requested Services.

We respond within 45 days, and may extend once by up to 45 more days where the law allows, with notice. If we decline your request, you can appeal by replying to our decision or emailing privacy@nextgentm.com with "Appeal" in the subject; we will answer within the time the applicable law sets, and if you are not satisfied you may contact your state attorney general. More detail: U.S. State Privacy Rights.

13. India

We process personal data of people in India on the basis of consent or, where the law permits, for legitimate uses such as providing a service you have asked for. India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are coming into force in phases; as each provision takes effect we will honour the rights it gives, including to access information about processing, correct, complete, update and erase your data, withdraw consent, nominate another person to exercise your rights, and obtain grievance redressal. We also follow the Information Technology Act, 2000 and its rules on sensitive personal data that currently apply.

Contact privacy@nextgentm.com for privacy requests and grievances. You may ask for information in English or in one of the languages listed in the Eighth Schedule to the Constitution, and we will help where we reasonably can. Complaints about purchases are handled under our Refund & Cancellation Policy.

14. South Africa

Under the Protection of Personal Information Act (POPIA) you may ask whether we hold your personal information and for access to it, ask us to correct or delete it, and object to processing, including for direct marketing. We send electronic marketing only with your consent or, for existing customers, about our own similar services with a free way to opt out in every message. We do not make decisions about you based solely on automated processing that have legal or substantial effects without the safeguards POPIA requires.

To request access to records under the Promotion of Access to Information Act (PAIA), email privacy@nextgentm.com with the subject "PAIA access request". This is separate from a deletion request. You may complain to the Information Regulator.

15. Children

The Services are for adults aged 18 and over. We do not knowingly collect personal data from children, and children's voices or likenesses may not be used to create AI identities through self-service features. If you believe a child has given us personal data, email privacy@nextgentm.com and we will delete it.

16. Cookies and similar technologies

Our hosting provider, Lovable, provides visitor measurement and click tracking on this site; both are switched on. Basic measurement records pages visited, the referring site, country, browser, operating system, device type, time on page, page speed and browser errors for every visitor, whatever you choose in our cookie settings. It sets no cookies and keeps no persistent storage on your device for basic measurement, and Lovable states that it does not keep IP addresses or recognise returning visitors. Click tracking records which buttons and links are clicked, including their visible text or label. Clicks (and any events our site sends) are recorded only if you accept Analytics in our cookie settings: clicks made earlier on the same page are held in the page and sent once you accept, and discarded if you reject or leave. They are never recorded when your browser sends Global Privacy Control. Lovable collects this data for us, keeps detailed data for 90 days and visit summaries and daily totals for one year. We use it to understand how the site is used and to find errors. See Lovable's privacy policy at https://lovable.dev/privacy.

Our optional cookies, browser storage and analytics tags (including Google Analytics) stay off until you choose to allow them, and Global Privacy Control turns them off. Details and your settings: Cookie Policy and Your Privacy Choices.

17. Changes

We will post updates here with a new date and version, and tell you directly about material changes where the law requires. We will ask for your consent again before using data for a new purpose that requires it.

18. Contact

NextGenTM, Inc., 831 N Tatnall Street, Suite M #275, Wilmington, DE 19801, United States — privacy@nextgentm.com.