This Privacy Policy explains how Looops(“Looops”, “we”, “us”, “our”), collects, uses, discloses, and protects information when you use looops.ai and the related Service.
We aim to keep this short and honest. If anything is unclear, email us at info@looops.ai and we will explain.
1. Information We Collect
Account information
When you sign up we collect your email address. If you sign in with Google we also collect your name and profile image as provided by Google. You may add or update a name and avatar later. We do not store passwords because we use email magic codes and OAuth.
Project content
We store the prompts you send to the AI, the conversations and message history, files you upload, the generated code and assets that make up your projects, project metadata, and version history. This content is what the Service is designed to process for you.
Billing information
For Paid Plans we use Stripe to process payments. Stripe collects your payment-method details directly — we do not see or store your card number. We receive and store a Stripe customer reference, your subscription status, billing history, and invoices.
Form submissions on your sites
Sites you publish can include forms. When a visitor fills out one of those forms, Looops receives the submission so we can deliver it to you (typically by email). For this data, you are the data controller and Looops acts as a processor on your behalf. You are responsible for telling your visitors how their data is used in your own privacy policy.
Visits to sites we host
When someone visits a site published with Looops, we count the page view for our own platform statistics (how much Looops is used): the page, the website or link that sent them, their country, their type of device and browser, and the time. We do this without cookies and without adding anything to the site. To tell one visitor apart from many visits, we combine the visitor’s IP address and browser details with a random value that changes every day and is deleted within two days, and turn them into a one-way code. The IP address and browser details themselves are never stored, and the code cannot be linked to the same person on another day or on another site. These counts are used only inside Looops to run and improve the service; they are not shown to site owners, never sold and never used for advertising. The visitor numbers site owners see come from Google Analytics, if they connect it (see below).
Google account data (when you connect Google)
If you choose “Connect Google” for a site, you sign in with your own Google account (once per workspace; its other sites can then use the same account) and allow Looops to use Google Search Console, Google Site Verification and Google Analytics for that site. We use this access only to do what you asked: verify that the site is yours, add it to your Search Console and submit its page list, create a Google Analytics property for it in the Analytics account you choose (or in a new account you name, if you ask for one), or reuse the one already tracking it, add Google’s tags to its pages, and show you its Google Search and Google Analytics numbers in Looops (including when you ask the Looops assistant about them). We keep the access token Google gives us, encrypted, together with your Google email address and the identifiers of what we set up. We do not store your Google data itself: it is read from Google when you look at it and kept in memory for up to a day. We never sell it, use it for advertising, use it to train AI models, or share it with anyone except as needed to show it to you. You can disconnect a site at any time from its SEO tab; disconnecting the last site that uses a Google account also withdraws our access at Google. You can also remove Looops from your Google account’s security settings at any time.
Looops’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When Google Analytics is set up for a site, it uses Google’s cookies on that site. As the site owner you decide how to inform your visitors and, where the law requires it (for example in the European Economic Area, the United Kingdom and Switzerland), ask for their consent, for example with a cookie banner. For that data Google is the provider you chose, under Google’s own terms.
Technical and usage data
When you use the Service we automatically collect logs that include your IP address, browser type, device characteristics, the pages and API endpoints you access, timestamps, and error information. We use this data to operate, secure, debug, and improve the Service.
Cookies and local storage
The Service uses your browser’s local storage to keep you signed in (an authentication token) and to remember small UI preferences such as a return URL after login. We do not currently use third-party advertising cookies. We do not run a third-party product-analytics tracker. Visit counting on sites you publish uses no cookies at all.
2. How We Use Information
We use the information we collect to:
- operate the Service, including authenticating you, generating AI output, hosting previews, and publishing your sites;
- process payments, manage subscriptions, and apply credit allowances;
- communicate with you about your account, security alerts, transactional notices, and service updates;
- provide support through the in-product live chat and email;
- monitor usage to detect, prevent, and respond to fraud, abuse, and security incidents;
- comply with legal obligations and enforce our Terms.
3. Legal Bases (EEA, UK, and Switzerland users)
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR / UK GDPR:
- Contract: to deliver the Service you requested.
- Legitimate interests: to secure, debug, and improve the Service, prevent abuse, and operate our business in a reasonable way.
- Legal obligation: to keep tax and accounting records and to respond to lawful requests.
- Consent: where we ask for it (for example, certain marketing emails). You can withdraw consent at any time.
4. AI Model Providers
When you use the AI features, your prompts and the relevant project context are sent to one or more third-party large-language-model providers to generate the output you requested. The providers we currently use include Anthropic, xAI, OpenAI, and Google (for Gemini). These providers process your inputs under their own terms and, for API-based access, generally do not use those inputs to train their models.
Looops does not train models on Your Content. We do not sell, rent, or share Your Content with third parties for advertising or for training models that we do not operate.
5. Sub-Processors and Service Providers
We rely on the following third-party services to operate Looops. Each receives only the data it needs for its specific purpose:
- Amazon Web Services (AWS) — hosting, databases, file storage (EFS, S3), email delivery (SES), background jobs (SQS), and preview environments (ECS). Region: United States.
- Cloudflare — hosting of published sites, object storage (R2), DNS / TLS for custom domains, and storing the visit counts for the sites we host (Workers Analytics Engine).
- Stripe — payment processing, subscription management, invoicing.
- Google — OAuth sign-in (when you choose it), Gemini AI model API, and Search Console, Site Verification and Analytics for sites whose owner connects Google.
- Anthropic, xAI, OpenAI — large-language-model APIs used to generate code and text in response to your prompts.
- Unsplash, Runway, ElevenLabs — optional media services (stock images, AI video, AI voice). Used only when you trigger the relevant feature.
- GitHub — deployment infrastructure.
- Slack — internal channel for receiving error alerts and support messages from Looops staff.
- Upstash (Redis) — transient state and caching.
We will keep this list reasonably up to date. If we add a new sub-processor that materially changes how we handle your data, we will update this page.
6. International Data Transfers
We are based in Canada, and several of our sub-processors are based in the United States. Personal data therefore moves across borders, including to the United States and other countries where our service providers operate. Where required, we rely on recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses, the UK Addendum, and equivalent safeguards offered by our providers. Canada has been recognized by the European Commission as providing an adequate level of protection for personal data transferred from the EEA.
7. Data Retention
- Account data: kept while your account is active and for up to 30 days after a deletion request, except for records we must keep longer for legal or accounting reasons.
- Project content (Paid Plans): kept while your subscription is active.
- Project content (free tier): projects inactive for 30 days may be deleted; we send a warning email at day 27.
- AI conversation history: retained for up to 90 days of inactivity, after which messages may be deleted.
- Billing records: retained for the period required by tax and accounting law (typically 6–7 years).
- Visit counts for the sites we host: kept for 3 months, then deleted automatically.
- Technical logs: retained for a short period (generally 30–90 days) for debugging and security.
8. Your Rights
Depending on where you live, you may have rights to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- delete your data (“right to be forgotten”);
- restrict or object to certain processing;
- receive a copy of your data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local data-protection authority.
To exercise any of these rights, message us in the in-product live chat or email info@looops.ai. We will respond within 30 days. We may need to verify your identity before completing a request. We will not discriminate against you for exercising a right.
Account deletion: the fastest way to delete your account is through the live chat in the product. We will permanently delete your account and content within 30 days, subject to retention required by law.
9. California Residents
California residents have additional rights under the CCPA / CPRA, including the right to know what categories of personal information we collect, to delete personal information, to correct inaccurate personal information, to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising and we do not use sensitive personal information for inferring characteristics. To exercise these rights, contact us as described in Section 8.
10. Security
We use industry-standard practices to protect your data, including encryption in transit, encryption at rest where supported by our providers, role-based access controls, signed authentication tokens, and isolated preview environments. No system can be guaranteed completely secure. If we ever experience a breach that affects you, we will notify you and the relevant authorities as required by law.
11. Children
The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided us with personal information, contact us at info@looops.ai and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes — including a change to the legal entity that operates the Service — we will give you at least 30 days’ notice on this page and, where reasonable, by email.
13. Contact
Questions, requests, and complaints can be sent to:
Looops
Email: info@looops.ai
Live chat: available inside the product
If you are in the EEA, the UK, or Switzerland and are not satisfied with our response, you may contact your local data-protection authority. If you are in Canada, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.