Privacy Policy

Last updated: July 1, 2026

This Privacy Policy explains how Loop LLC ("Loop," "we," "us") collects, uses, and protects information in connection with the Loop platform (getlloop.com). It covers two distinct roles Loop plays, which is important for understanding your rights:

For account-holder data (the people who sign up for and use Loop), Loop is the data controller.
For Customer's contact and prospect data(the leads, contacts, and prospects a Customer imports, enriches, or emails through Loop), Loop's Customer is the data controller and Loop LLC acts as the data processor, acting only on Customer's instructions.

If you are a contact or prospect who received an email sent through Loop, or whose information was imported into Loop, please direct privacy requests to the business that used Loop to contact you first. If that is not practical, contact us at legal@getlloop.com and we will route your request to the relevant Customer or handle it directly where appropriate.

1. Information we collect

Account data: name, email address, and a securely hashed password (bcrypt) for anyone who creates a Loop account, plus team membership and role information.

Customer-imported contact data: when a Customer imports or connects contacts and prospects, Loop processes whatever fields the Customer supplies or enriches — for example name, email address, job title, company, LinkedIn URL, and engagement history (opens, clicks, replies). Loop processes this data as instructed by the Customer, who is the controller of it.

Provider credentials: API keys and OAuth tokens for third-party integrations a Customer configures (for example AI providers, email-sending providers, or mailbox OAuth) are encrypted at rest using AES-256-GCM.

Email content and engagement tracking: outbound emails sent through Loop include invisible open-tracking pixels and click-tracked links so Customer can measure engagement. Loop records when an email is opened or a link is clicked, and associates that event with the recipient contact record.

Lead-capture form submissions: when a visitor submits a lead-capture form on a Customer's published article or site, Loop records the submitted fields (for example name, email, and message) on behalf of that Customer.

2. Cookies

Loop uses only strictly-necessary cookies — specifically a session authentication cookie required to keep you signed in. Loop does not use advertising cookies, third-party analytics cookies, or any cookie that requires consent under applicable ePrivacy law. Because Loop does not set non-essential cookies, we do not display a cookie consent banner.

3. Sub-processors

Loop uses sub-processors to provide the Service. The specific sub-processors engaged for a given Customer depend on which integrations that Customer configures. Categories of sub-processor include:

AI model providers (for example Anthropic, OpenAI, DeepSeek, Google Gemini) — used for SEO content generation and email drafting;
Email-sending infrastructure (for example AWS SES) — used to deliver outbound campaigns;
Mailbox OAuth providers (Google, Microsoft) — used to connect a Customer's sending mailbox and unified inbox;
Contact-data and enrichment providers (for example People Data Labs) and email-verification services — used to build and validate prospect lists;
Twilio — used for call/SMS-adjacent features where enabled;
Hosting, database, and infrastructure providers (for example Vercel, Neon, Upstash, Inngest) — used to run the application, store data, cache, rate-limit, and schedule background jobs.

We maintain data processing terms with our sub-processors consistent with our obligations under GDPR and equivalent laws. A current list of active sub-processors for your account is available on request at legal@getlloop.com.

4. Retention

We retain account data for as long as the account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements. Customer contact and prospect data is retained per the Customer's configuration and instructions, including suppression/unsubscribe records, which we retain indefinitely so that a previously-unsubscribed or erased address is not re-imported and re-contacted.

5. Your rights (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, individuals have the right to access, export, correct, and erase their personal data, and to object to or restrict certain processing. For account holders, Loop provides an in-app data export tool and honors deletion requests sent to legal@getlloop.com. For Customer contact and prospect data, Loop provides its Customers with in-app tools to export a full record of what is held about a contact and to erase a contact's personal data (which anonymizes the record and preserves only a suppression entry so the address cannot be re-imported and re-emailed). If you are a contact who wants to exercise these rights directly, email legal@getlloop.com and we will either action the request or direct it to the relevant Customer as required.

Account deletion for account holders is currently handled by request — contact legal@getlloop.com to request deletion of your account.

6. International transfers

Loop and its sub-processors may process and store data in countries other than where you or Customer's contacts are located, including the United States and the United Arab Emirates. Where we transfer personal data protected by GDPR or UK GDPR internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognized under applicable law.

7. Security

We use industry-standard technical measures to protect data, including HTTPS/TLS in transit for all traffic, AES-256-GCM encryption at rest for stored integration credentials, hashed (bcrypt) account passwords, and role-based access controls within each Customer's team. No method of transmission or storage is 100% secure, but we work to protect data using measures appropriate to its sensitivity.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to legal@getlloop.com.