Privacy Policy · loopling

1. What loopling collects

Account data

• Email address — your login identifier.
• Google sub claim — if you sign in with Google, the stable opaque user id Google provides. We use it to confirm "same Google account = same user" across sessions.
• createdAt, lastActiveAt — admin diagnostics: who's been using Loopling and when.
• Free-form admin note (note field) — an admin may write a private note about who you are (e.g. "met through Vimeo", "studio in Tokyo") to remember context across long gaps. Visible only to admins.

Content data

• Spaces — each space you create, including the layout of every node, every connection, the camera position, and a per-space "muse memory" Muse may write about your work.
• Conversations — your chats with Muse, including the messages you wrote and her replies.
• Files — every image, video, audio file, PDF, or other binary you upload or generate, plus the metadata Loopling needs to display it (filename, MIME type, size).
• References — when Muse searches the web for images or fetches a URL on your behalf, the metadata about each result (title, source URL, creator, license) and any image preview that Loopling proxied.

Billing data

• Stripe customer id — Loopling's pointer to your billing record on Stripe. Created lazily on your first paid action.
• Subscription state — your current tier, status (active / trialing / past_due / canceled), and period_end date.
• Ink ledger — every Ink debit, credit, and reservation, with timestamps and the endpoint that triggered it. We need this to show you a monthly activity log and to reconcile against AI provider invoices. For paid Muse rounds, the ledger also keeps the names of browser tools Muse requested and whether visible text was produced, so Loopling can identify read-only rounds eligible for an Ink refund.
• Quota usage — per-day and per-month aggregates of how much Loopling owed AI providers on your behalf.
• Activity log — per-call audit row (endpoint, model, latency, cost, loop round, and bounded operational metadata such as the names of Muse tools sent to your browser and server-side tool-search counts/observed timing spans) retained 30 days for debugging and abuse review. These operational fields do not contain tool inputs, search queries, or result content.
• Ink Gift records (gift_cards) — if you buy or receive an Ink Gift, one row per Gift holding: which account bought it, which account claimed it (empty until someone does), the face value, the lifecycle status, the timestamps for funding / cancellation / claiming, the Stripe price, checkout-session, payment-intent, refund and event ids, the refund accounting, and a pointer to the Ink ledger entry the claim created. We need this to fund exactly one Gift per payment, to enforce "claimed once", and to reconcile refunds and disputes against Stripe.

Two things this deliberately does not do. It stores no message, no recipient email address you typed, and no delivery record — Loopling never sends the Gift for you, so we never learn who you meant it for; you carry the link yourself. And the two accounts stay hidden from each other: the buyer sees only whether their Gift has been claimed, never the identity or email of the person who claimed it, and the recipient is not shown who bought it unless the buyer told them.

We do not see or store your full payment-card number — card details go directly to Stripe, our payment processor.

Investor deck access data

• Self-reported email address — the email a visitor enters after receiving a private Loopling deck code. The code is the access credential; we do not verify that the visitor controls the address.
• Successful code-entry record — the invitation id, first and latest successful entry time, and successful-entry count.
• Private-deck session and device records — opaque one-way token digests, invitation id, creation / latest-use / expiry / revocation times. These records contain no email address, raw invitation code, IP address, user agent, or browser fingerprint.
• Invitation record — an operator-written label (which may name a fund or recipient), a one-way digest of the code, expiry / revocation times, device limit, and creator account id. Legacy invitations may also contain a keyed email HMAC and masked email hint; newly issued codes are not email-bound.
• Reading events — slide views and evidence opens, associated with the invitation and browser session. Reading activity is pooled by invitation code and is not represented as verified person-level attribution.

We use this data only to provide private deck access, understand whether the material was opened, and follow up about Loopling. We do not add these email addresses to a marketing list. We do not record dwell time, pointer movement, raw IP address, user agent, failed-entry email addresses, or the raw invite code. For abuse prevention, a one-way hash of the requesting IP and the code digest are held in Redis for about 16 minutes after the latest attempt.

What we do NOT collect

• Telemetry — Loopling doesn't run Google Analytics, Mixpanel, Segment, FullStory, Hotjar, or any third-party analytics SDK. No tracking pixels, no fingerprinting.
• Cross-site cookies — see the cookie policy.
• Behavioural advertising profiles — Loopling doesn't sell any advertising; there's no profile to build.
• Voice / speech input — we don't capture audio of you talking, even if you use a voice-to-text input on your own device.

2. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases:

• Performance of a contract — to create your account, sync and store your spaces and files, route your generation requests, and process payments. Without this we can't provide the Service.
• Legitimate interests — to keep the Service secure, prevent abuse and fraud, debug problems, reconcile vendor costs, protect private investor materials, and follow up with people who successfully access those materials. We balance these against your rights.
• Legal obligation — to keep tax and accounting records, and to respond to lawful requests.
• Consent — where we ever ask for it specifically; you can withdraw consent at any time without affecting prior processing.

3. Where data is stored

Browser-side

When you're signed in, Loopling mirrors a working copy of your spaces, conversations, and files into your browser's IndexedDB so they load fast and work offline. This data is yours alone — it lives in the browser's per-origin sandbox; we can't see it remotely.

Server-side

The authoritative copy of your data lives on:

• Postgres (Supabase Pro) — accounts, invites, investor-deck access, spaces metadata, conversations, file metadata, billing tables, audit logs.
• Cloudflare R2 — file blobs (images, videos, audio, PDFs) and share-link snapshots.
• Redis (Upstash) — short-lived rate-limit windows.

All three are hosted in the United States.

What sub-processors see

We use the following third-party services. Each has a defined role and can only see the data needed for that role.

If we add or change a sub-processor in a way that materially affects data flow, we'll update this table and notify users 14 days before the change takes effect.

What AI providers do with prompts

The AI providers above each have their own policy on whether they train on API inputs. We direct your prompts to API endpoints whose terms prohibit training on input, and we track these policies and switch providers if any of them change the default to "trains on inputs without explicit opt-out." If you want a complete current list with citations, email hello@loopling.ai.

4. How long we keep data

Investor-deck retention cleanup runs daily; transient failures may delay deletion.

When you close your account: spaces / conversations / file blobs / ink_transactions are deleted within 30 days. Stripe billing records remain for the regulatory retention period. We may retain a hashed record of your email address for a brief period to honour suspensions (stops re-creating an account that was suspended for abuse).

An Ink Gift record is a payment record, so it survives on the same 7-year clock as the Stripe charge behind it — but de-identified: closing your account drops the link between the row and you, on both sides, leaving the amount, dates, status and Stripe ids with no account attached. If you close your account while a Gift you bought is still unclaimed, tell us first so we can refund it instead of leaving it stranded.

5. Your rights

Depending on where you live, you have some or all of these rights. We honour the core rights (access, correction, deletion, portability) for all users, not just those in a specific jurisdiction.

• See your data: every space, conversation, and Ink transaction is visible in the app. Email support if you want a structured export.
• Correct your data: account email and content are user-editable. Contact support for billing-record corrections.
• Delete your data: close your account from Settings; data goes through the 30-day deletion described above.
• Object / restrict: if you don't agree with a sub-processor we use, email support and we'll discuss alternatives. Some sub-processors (Stripe, the database host) can't be removed without making Loopling non-functional for you.
• Withdraw consent: where processing is based on consent.
• Lodge a complaint: with your local data-protection authority (ICO in the UK, your lead supervisory authority in the EEA, or a state attorney general in the U.S.).

California residents (CCPA/CPRA). In the past 12 months we have not sold or "shared" (as those terms are defined under California law) your personal information, and we do not do so. We do not process sensitive personal information to infer characteristics. You have the rights to know, delete, correct, and opt out; we don't discriminate against you for exercising them. Categories collected and their purposes are described in Sections 1–3.

To exercise any of these rights, email hello@loopling.ai. We respond within 30 days; complex requests may take longer, in which case we tell you the timeline up front. We may need to verify your identity (usually by confirming control of the account email) before acting.

6. International transfers

Your data is stored in the United States. If you're in the EU, EEA, or UK, your data is transferred to the U.S. and to our sub-processors under an appropriate transfer mechanism — typically the European Commission's Standard Contractual Clauses (and the UK Addendum), or a provider's Data Privacy Framework certification where available. The sub-processors listed above each commit to compatible safeguards. Email hello@loopling.ai for a copy of the relevant transfer terms.

7. Security

• In transit: TLS 1.2+ between you and Loopling; TLS between Loopling and every sub-processor.
• At rest: Postgres rows encrypted at rest by Supabase; R2 blobs encrypted at rest by Cloudflare. Database backups are similarly encrypted.
• Access control: only authorized personnel (currently Extensium's founder) and a small number of trusted contractors, when needed for support, can access production data; every access is logged.
• Sessions: session cookies are HttpOnly and Secure. Loopling account sessions are SameSite=Lax; private-deck sessions are SameSite=Strict and scoped to /deck. We rotate signing secrets periodically.
• Incident response: if we detect a security incident affecting your personal data, we'll notify affected users and any required authority within the timeframes the law requires (and in any case without undue delay).

We are not perfect. If you find a security issue, please email hello@loopling.ai — we'll respond quickly and keep you informed.

8. Children

Loopling is not directed to children. You must be at least 16 to use it (see the Terms). We don't knowingly collect personal data from anyone under 16; if we learn we have, we delete it and close the account.

9. Changes to this policy

Every new version is dated at the top, and the version it replaced stays permanently readable at https://loopling.ai/legal/privacy?version=YYYY-MM-DD.

How much warning you get depends on what changed:

• If it changes how we handle data you've already given us — a new sub-processor, a new purpose, a longer retention, a new category drawn from existing content — we email everyone with an active account at least 14 days before it takes effect.
• If it only describes data created by a new optional feature — processing that begins only if you choose to use that feature, and never touches anything you gave us before — it takes effect on publication, and you meet its disclosure at the point you use the feature.

Revision history

• August 23, 2026 — renamed the product from Atelier to Loopling and updated the addresses and contact email throughout. No new data category, purpose, sub-processor, retention period, or transfer was introduced, and nothing already collected is processed differently, so this version took effect on publication. The prior version is at /legal/privacy?version=2026-08-11.
• August 11, 2026 — disclosed the optional private Loopling investor deck's self-reported email, successful code-entry record, reading events, invitation metadata, opaque session/device records, short-lived abuse prevention hashes, and rolling 90-day deletion. This processing begins only when a visitor chooses to enter an invitation code, and the disclosure appears at that point, so this additive version took effect on publication. The prior version is at /legal/privacy?version=2026-08-05.
• August 5, 2026 — disclosed Ink Gift records (Section 1) and their retention (Section 4), and split the notice rule above. Gifts added no sub-processor and no new processing of anything already collected: a gift_cards row exists only if you choose to buy or claim a Gift, so this version took effect on publication. The prior version is at /legal/privacy?version=2026-06-05.

10. Contact

• Privacy questions, data-subject requests, and security reports: hello@loopling.ai
• Controller of record: Extensium Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, U.S.A.

loopling.ai · grows with you, grows itself

hello@loopling.ai · community · pricing · privacy · terms