This agreement applies whenever we process personal data on your behalf. That is mainly the feedback, votes and identity attributes your customers submit to your boards. It forms part of our terms of service and needs no separate signature. We will sign a copy on request.
Roles and scope
Looph is operated by Bose and Turing Innovations FZCO, a company in the IFZA free zone in Dubai, United Arab Emirates (IFZA trade licence 54549), registered at IFZA Properties, A1 - 3641379065, Dubai Silicon Oasis, Dubai, United Arab Emirates. In these documents "Looph", "we" and "us" mean that company.
Because we are established outside the EEA, we have appointed Plutonapps AS (organisation number 932 105 071, Norway) as our representative in the EEA under Article 27 of the GDPR. You or your supervisory authority can contact our representative about how we handle personal data through hello@looph.ing.
For workspace content, you are the controller and we are the processor. We process it only to provide the service and only on your documented instructions. We use it for no other purpose. Everyone at Looph who can access it is bound by confidentiality.
Data subjects: your customers, prospects and employees who use your boards. Types of data: identifiers, contact details, submitted content and the attributes you choose to send. Processing lasts for as long as you use the service.
Security measures
Data is encrypted in transit with TLS 1.2 or above. Our hosting and database providers encrypt it at rest with AES-256, and we also encrypt integration credentials and shipping addresses ourselves with AES-256-GCM.
Every database table has Postgres row-level security, and our server code checks workspace membership on every request. Staff use of our internal console is role-based, every administrative action there is logged, and destructive actions need a written reason.
Backups are automatic, daily and encrypted, and age out within 30 days. A written disaster-recovery runbook covers restoring them.
Subprocessors
We use these subprocessors: DigitalOcean (application hosting and server logs, United States); Supabase (database and file storage, United States); Clerk (sign-in, passwords, Google sign-in and two-factor authentication, United States); Resend (email delivery, United States); Stripe (payments and billing details, United States); Upstash (rate limiting, which processes IP addresses, United States); Cloudflare (DNS only, so no personal data passes through it). Each one is bound by written terms that protect data at least as well as this agreement. We give notice before adding or replacing a subprocessor so that you can object.
International transfers
Data is stored and processed in the United States. When it is transferred out of the EEA, the UK or Switzerland, we rely on the Standard Contractual Clauses, with the UK addendum where it applies.
Incidents
If a personal data breach affects your workspace, we notify you without undue delay, and in any case within 72 hours of becoming aware of it. We tell you the facts known at the time and the steps we are taking.
Assistance, audits and deletion
We help you respond to data subject requests and to enquiries from regulators. On request, we provide the information you need to show compliance. Under an enterprise agreement, we also support one reasonable audit a year.
When the agreement ends, we delete or return personal data as you direct. Deleting a workspace removes its personal data immediately; copies in backups age out within 30 days, as our privacy policy describes.