This policy explains what we collect when you use Looph, why we collect it and what you can ask us to do with it. We have written it in plain language on purpose; where a term has a specific legal meaning under the GDPR or CCPA we say so.
Who is responsible for what
Looph is operated by Bose and Turing Innovations FZCO, a company in the IFZA free zone in Dubai, United Arab Emirates (IFZA trade licence 54549), registered at IFZA Properties, A1 - 3641379065, Dubai Silicon Oasis, Dubai, United Arab Emirates. In these documents "Looph", "we" and "us" mean that company.
For your workspace account — the people you invite, your billing details and your usage of the product — we are the data controller.
For the feedback your customers submit to your boards, you are the controller and we are the processor. You decide what to collect and how long to keep it; we process it on your instructions under our data processing agreement.
What we collect
Account data: your name, email address, profile photo, workspace memberships and roles. Passwords, Google sign-in identities and two-factor factors are held by our sign-in provider, Clerk, not by us.
Content data: posts, votes, comments and reactions; images you upload, such as workspace logos, avatars and changelog media; and, when your product uses the widget, the identity details your server signs into the widget token: a user id and optionally an email address, name, locale, company and up to 20 custom attributes.
Technical data: IP address, user agent and timestamps in our security and audit logs, plus server error logs. For widget sessions and referral tracking we keep only a hashed IP address.
Billing data: Stripe collects and stores your billing name, address, tax identifier and card. We keep your plan, your subscription status and your Stripe customer id.
How we use it, and our legal basis
To provide the service: running your workspace, signing you in, billing you and sending the notifications you or your customers have chosen. The legal basis is our contract with you.
To keep the service secure and working: rate limiting, abuse prevention, audit logs and debugging. The legal basis is our legitimate interest in a safe, reliable service.
To count signed-out visitors and credit referrals. We do this only if the visitor accepts the cookie banner, so the legal basis is consent, which can be withdrawn at any time.
To keep invoices and records the law requires. The legal basis is legal obligation.
We do not sell personal data, and we do not use your workspace content to train AI models. Looph does not currently send workspace content to any AI provider. If we turn on optional AI features, we will add the provider to the list below and give notice first.
We make no decisions about people by automated means that have legal or similarly significant effects.
Cookies and similar storage
Strictly necessary cookies: our sign-in provider's session cookies (such as __session), the cookies that carry your sign-in to a workspace's custom domain, short-lived security cookies used while you connect an integration, the cookie that remembers your consent choice (six months), and one that remembers whether the sidebar is open.
Cookies that need consent: a referral cookie that lasts 30 days and an anonymous visitor id. We set them only after a signed-out visitor accepts the banner.
Your browser also stores a few preferences locally, such as your light or dark theme and which welcome messages you have dismissed. These never leave your device.
Our product analytics are first-party: we record them in our own database and use no third-party analytics service. A workspace can choose to forward its own events to its own Segment account.
Who we share data with
We use these subprocessors: DigitalOcean (application hosting and server logs, United States); Supabase (database and file storage, United States); Clerk (sign-in, passwords, Google sign-in and two-factor authentication, United States); Resend (email delivery, United States); Stripe (payments and billing details, United States); Upstash (rate limiting, which processes IP addresses, United States); Cloudflare (DNS only, so no personal data passes through it). We give notice before adding a new one.
When a workspace connects an integration, such as Slack, Discord, GitHub, Jira, Zapier, Segment, Printful or Tremendous, we send that service the data the workspace chooses to send. The workspace's own agreement with that service covers it.
Your data is stored and processed in the United States. Where it leaves the EEA, the UK or Switzerland, we rely on the Standard Contractual Clauses, with the UK addendum where it applies.
Retention
Workspace content is kept until the workspace is deleted. Deleting a workspace is immediate and permanent: its boards, posts, comments and memberships are removed at once and cannot be recovered, so export your data first. Images that nothing uses any more are purged within 24 hours. Copies held in our backups age out within 30 days and are never used to restore a deleted workspace.
Other data is deleted on a schedule. IP addresses and user agents are cleared from our logs after 30 days. Email send logs go after 90 days, product analytics and notification history after 13 months, and audit and security logs after one year. Export files are kept for 7 days. Invoices are kept for the period tax law requires.
Your rights
You can access, correct, export or delete your data at any time. Export is self-service in the product, for your own account and for a whole workspace. You can delete your own account in Settings once you no longer own a workspace, and deletion takes effect immediately. You may also object to processing, restrict it, withdraw consent or lodge a complaint with your supervisory authority.
As a workspace admin, you can export or erase everything about one of your customers from Settings, then Data, to answer their request.
Every email we send to your customers has a one-click unsubscribe link, and each person can choose which notifications they receive.
If you are an end user who submitted feedback to a company's board, contact that company first: they control the board. We will help them respond and will act directly where the law requires it.
Looph is a business tool and is not directed at children under 16.
Contacting us
Email hello@looph.ing with any request or question about this policy. We respond within 30 days, and usually far sooner.
By post: Bose and Turing Innovations FZCO, IFZA Properties, A1 - 3641379065, Dubai Silicon Oasis, Dubai, United Arab Emirates.
Because we are established outside the EEA, we have appointed Plutonapps AS (organisation number 932 105 071, Norway) as our representative in the EEA under Article 27 of the GDPR. You or your supervisory authority can contact our representative about how we handle personal data through hello@looph.ing.