This policy explains what we collect when you use Looph, why we collect it and what you can ask us to do with it. We have written it in plain language on purpose; where a term has a specific legal meaning under the GDPR or CCPA we say so.
Who is responsible for what
For your workspace account — the people you invite, your billing details and your usage of the product — we are the data controller.
For the feedback your customers submit to your boards, you are the controller and we are the processor. You decide what to collect and how long to keep it; we process it on your instructions under our data processing agreement.
What we collect
Account data: name, work email, password hash or SSO identifier, workspace settings and role.
Content data: posts, votes, comments, attachments and the identity attributes you choose to pass with the identify call.
Technical data: IP address, user agent, timestamps and error traces. We use these for security, abuse prevention and debugging.
Billing data: company name, billing address and tax identifiers. Card details are handled by our payment processor and never reach our servers.
How we use it
To provide the service, authenticate users, send notifications you or your customers have opted into, prevent abuse, meet legal obligations and improve the product in aggregate.
We do not sell personal data, and we do not use the content in your workspace to train models that serve other customers.
Cookies and analytics
We set a session cookie required to keep you signed in, and a preference cookie for theme. Product analytics are first-party, aggregated and can be disabled per workspace.
Subprocessors and transfers
We use a small set of subprocessors for hosting, email delivery, error monitoring and payments. The current list is available on request and we give notice before adding a new one.
Where data leaves the EEA or UK we rely on Standard Contractual Clauses and the UK addendum. EU-only data residency is available on request.
Retention
Workspace content is kept while your account is active. After deletion it is recoverable for 30 days, purged from primary storage at day 30 and from backups within a further 35 days. Invoices are kept for the period tax law requires.
Your rights
You can access, correct, export or delete your data at any time — export and deletion are self-service in the product. You may also object to processing or lodge a complaint with your supervisory authority.
If you are an end user who submitted feedback to a company's board, contact that company first: they control the board. We will help them respond and will act directly where the law requires it.
Contacting us
Email privacy@looph.io with any request or question about this policy. We respond within 30 days, and usually far sooner.