Draft — to be reviewed by a lawyer before launch
Privacy Policy
Last updated: · Provided by [Company legal name] · Questions: [legal@your-domain]
This policy explains what personal data Loopin handles, why, for how long, and what rights you have. It is written for the people who use a Loopin workspace, for the owners who run one, and for visitors to this website.
1. Who is responsible
[Company legal name], [Company registered address] (“Loopin”, “we”), runs Loopin. Our role depends on whose data it is:
- Workspace data (the people, posts, messages, tasks, attendance and everything else inside a company’s workspace): the company that created the workspace, usually your employer, decides why and how it is used and is the controller. We are its processor and act on its instructions, under the Data Processing Agreement. If you are an employee and want to see, correct or delete your workspace data, ask your employer first (see section 8); we help them do it.
- Our own data (owners’ account and billing contacts, visitors to this website, people who write to us, security logs of our own service): we are the controller.
- Payments are collected by Paddle, our merchant of record, which is an independent controller of the payment data it collects. See section 5.
Contact for privacy questions: [legal@your-domain].
2. The data we process
| Category | Examples |
|---|---|
| Account and profile | Name, work email, optional phone number, job title, team, profile photo, interests, language, time zone, role (member, HR manager, administrator, owner). Passwords are stored only as irreversible hashes; authenticator secrets are stored encrypted. |
| Content you post | Feed posts, comments, kudos, poll votes, chat messages and group chats, files and photos you upload (scanned for viruses), announcements and who has read them (read receipts), support tickets. |
| Private tasks | Your own tasks, notes, reminders and subtasks. They are private to you; no manager or owner can see them. |
| Pulse surveys | Answers are stored only as counts per option. Who took part is stored as a keyed hash, not as a name next to an answer. Counts are hidden until at least five people have answered. |
| Rewards | Points, levels and the history of what earned or spent them. |
| Attendance | Check-in and check-out times and how each was made (office QR code, remote, client site, shared kiosk), planned shifts and breaks, correction requests and approvals. A device is recognised by a keyed hash of its identifier, never by the identifier itself. A kiosk PIN is stored as a hash; a badge number is stored for the kiosk lookup. |
| Location (inside or outside only) | Only if your company’s attendance rules ask for it. Your device’s position is sent once, at the moment you check in, to be compared with the work site. We keep only the result (inside or outside, the distance and the accuracy), not your coordinates. We do not track your location at other times and have no map of where you have been. |
| Face data | Only with your explicit consent. See section 3. |
| Calls | Audio and video pass through our own call server and are not recorded or stored. We keep a call history entry (who, when, how long, whether answered). |
| Devices and notifications | A push token for each device you sign in on (from Google’s Firebase Cloud Messaging, and Apple for iPhones), your notification settings and quiet hours. A push can contain a short text, such as the sender and the start of a chat message or the title of a must-read announcement. People who are online or have muted a chat are not pushed. |
| Security and technical | Sign-in sessions, IP address and browser or device details of requests, rate-limit counters, and an audit log of security-relevant actions (who changed which setting, role or person, and when). Error reports have personal data removed before they are sent. |
| Billing (owners) | We receive from Paddle: customer and subscription identifiers, the plan, seats, status, price and period, the card brand, last four digits and expiry (shown to owners in Billing), invoice numbers and totals. We never see full card numbers. We send Paddle the workspace identifier, the plan and the number of seats, and nothing about your people. |
| This website | If you use the contact form: your name, work email, company, company size and message, plus your IP address and the result of the Cloudflare Turnstile check. We do not use advertising or analytics scripts on this site. |
3. Face data (biometrics)
Some workspaces use a face check when people check in remotely or at a shared kiosk. It is optional for the company to switch on and it is never used without your consent.
- Consent first. Before anything is made, the app asks for your explicit, versioned consent, for the one purpose of checking attendance. Without it, no face data is created, and you can check in another way (a kiosk PIN or badge, or a manager’s approval).
- A template, not a photo. When you enrol, a selfie is turned into a numerical face template. The selfie is processed in memory and dropped; we do not keep it. The template is stored encrypted (AES-256-GCM) and no screen or export shows it.
- Matching happens on our own server. At check-in a new selfie is compared with your template inside our own server process. No outside face-recognition service is called.
- When a selfie does not match, a small, encrypted review copy is kept so that a manager can decide on the check. It is deleted when the manager decides, when you withdraw consent, or after 30 days at most.
- Your control. You can withdraw consent or remove your face at any time in the app. Your template (and any pending one or review copy) is then deleted. It is also deleted when your account is erased or the workspace is deleted. Face templates are not part of data exports.
Face data is a special category of personal data. Some countries and US states have specific rules on it (for example the GDPR, and the Illinois Biometric Information Privacy Act), and your employer is responsible for using the feature lawfully where it works. [Wording on consent in an employment setting to be reviewed by the lawyer.]
4. Why we use it
| Purpose | Legal basis (GDPR and similar laws) |
|---|---|
| Providing the workspace to the company and its people: feed, chat, announcements, tasks, rewards, attendance | As processor, on the company’s instructions. The company’s own basis is its to state (usually the employment contract and its legitimate interests). |
| Creating and running owners’ accounts; billing; support | Performance of a contract with the owner’s company; legal obligations (tax and accounting records) |
| Keeping the service secure, preventing abuse and fraud, rate limiting, the audit log, fixing faults | Our legitimate interests in a secure service |
| Answering messages from the contact form and following up on sales enquiries | Steps at your request before entering a contract; our legitimate interests |
| Face check for attendance | Your explicit consent (and, in the company’s relationship with you, whatever the law that applies to it requires). You can withdraw it. |
| Sending service emails (codes, invitations, security and deletion notices) and push notifications you have not switched off | Performance of the contract; the company’s instructions |
We do not sell personal data, we do not use it for advertising, and we do not use workspace content to train models.
6. International transfers
Some of our sub-processors are outside your country or the European Economic Area. Where personal data is transferred to such a country, we rely on [International transfer mechanism, e.g. Standard Contractual Clauses, to be completed once the hosting region and providers are final].
7. How long we keep it
| Data | Kept |
|---|---|
| Messages and posts | As long as the workspace’s owner has chosen: forever, 3 years or 1 year. Older items are deleted automatically. |
| Finished private tasks | Deleted one year after they were completed |
| Face template | Until you remove it, withdraw consent, your account is erased or the workspace is deleted |
| Review copy of a selfie that did not match | Until a manager decides, and 30 days at most |
| Attendance held for approval | 7 days at most, then it expires |
| Data exports you request | The download link works for 15 minutes; the file is deleted after 24 hours. Payroll files: 1 hour. |
| Realtime notification payloads | Emptied as soon as they are delivered; the row is removed after a day |
| Sign-in codes | Minutes |
| A person’s data after the company erases them | Their personal and private data is deleted and the profile is anonymised; their name is removed from the audit log |
| A deleted workspace | Read-only for 30 days (everyone can still export), then every row, stored file, cache key and queued job is deleted. A record of identifiers and dates remains. |
| Contact-form messages | [retention period for contact-form messages] |
| Invoices and payment records | As long as tax and accounting law requires (held by Paddle and by us) |
Backups [retention to be completed before launch] are deleted on their normal cycle after the live data is gone.
8. Your rights
Depending on where you live, you can ask to access your data, correct it, delete it, receive it in a portable form, restrict or object to some uses, and withdraw consent at any time. You can also complain to your data-protection authority.
- Access and portability: in the app, Profile and settings, Download my data gives you a zip of your own data.
- Correction: edit your profile in the app, or ask your owner or HR manager.
- Erasure: an owner can erase a person from the workspace in the console. If you are an employee, ask your employer; they decide, and we carry it out. If you are a visitor or an owner of ours, write to [legal@your-domain].
- Face data: withdraw consent or remove your face in the app at any time.
- Workspace owners can export all of the workspace’s data, change how long messages and posts are kept, and delete the workspace.
If you write to us about workspace data, we may pass your request to your employer, who is the controller, and tell you that we did.
10. Security
Workspaces are isolated from each other in the database, sensitive items are encrypted, access is limited by role and sensitive actions need a password and a code. See the security page for what we do and what we have not yet done.
11. Children
Loopin is for workplaces. It is not meant for anyone under 16, and we do not knowingly collect data from them.
12. Changes and contact
If we change this policy in a way that matters, we will tell owners by email and show the new date at the top. Questions, requests and complaints: [legal@your-domain], [Company legal name], [Company registered address].