Roles
For the fan data you cause LootKeep to process, you are the data controller and LootKeep is your data processor. LootKeep is operated by Antonio Laguna Matías, trading as LootKeep, a sole trader (autónomo) based in Spain. We process fan data only to run the service for you, never for our own purposes.
What we process
Subject matter: delivering gated reward files to your fans. Duration: for as long as your account is active, then per the wind-down and deletion schedule in the Terms. Data subjects: your fans (the people who open your pack links). Categories of data: a stable Patreon identifier, a display name, the tier membership that decides access, and download activity. We do not receive or store fan passwords, and fan payments stay entirely with Patreon.
Our instructions
We process fan data only on your documented instructions, which for the ordinary running of LootKeep means the actions the product takes for you: authenticating a fan through Patreon, checking their tier, and serving the files they're entitled to. Everyone at LootKeep with access to the data is bound by confidentiality.
Security
We keep files encrypted in transit and your Patreon connection tokens encrypted at rest, and we serve files only through short-lived, single-purpose links to fans a tier or grant unlocks. We host in the EU and keep the data we hold on fans deliberately small: an identifier and a name.
Sub-processors
We use a short list of trusted providers to run the service, each only for what its row says. This is the same list published in our Privacy Policy:
- Stripe Payments Europe, Ltd. (Link) · Ireland (EU)Subscription payments, tax calculation, invoicing and refunds, as merchant of record. Link is the customer-facing checkout surface; card details are held by Stripe, never by LootKeep.
- Cloudflare · EU jurisdictionReward-file storage (R2) and website delivery, on infrastructure under EU jurisdiction.
- Railway · EU (Amsterdam)Application and database hosting.
- Patreon · United StatesCreator and fan identity, and the tier membership that decides what a fan can download.
- Resend · United StatesTransactional and account email delivery.
Each sub-processor is bound by data-protection terms at least as protective as this addendum. We'll give notice of any new sub-processor so you have a chance to object.
For the fan data this addendum covers, the processors that actually touch it are Cloudflare (file storage), Railway (hosting) and Patreon (identity and tier). The billing and account providers are listed for completeness: they handle your own subscription and account data, for which LootKeep is the controller, not fan data under this addendum.
International transfers
Your reward files never leave the EU. Where a processor of fan data sits outside the EU (Patreon, for identity), the transfer relies on appropriate safeguards, such as the EU Standard Contractual Clauses.
Data-subject requests
If one of your fans exercises a GDPR right (access, correction, export, or erasure) with us, we'll help you respond, and where a request reaches us directly we'll pass it to you rather than act on our own. Because we hold so little, most requests are quick to satisfy.
Return & deletion
When your account closes, fan data is deleted or returned on the schedule set out in the Terms, unless we're required by law to keep something (for example billing records). We don't retain fan data beyond what running your packs needs.
Contact
Questions about this addendum, or need a signed copy for your records? Email [email protected] and a human in the EU will get back to you.