Draft — to be reviewed by a lawyer before launch
Sub-processors
Last updated: · Provided by [Company legal name] · Questions: [legal@your-domain]
Loopin uses the services below to run the product. Each one can receive personal data from a workspace, or from this website, as described. The list is kept in step with the product: a new service is added here before it handles customer data, and owners are told of it. See also the Privacy Policy and the Data Processing Agreement.
External services
| Service | Purpose | Personal data | Location | Status |
|---|---|---|---|---|
| Hosting provider [to be named before launch] | Runs the servers, database and file storage for every Loopin workspace. | All workspace data, encrypted at rest on the provider’s disks. | [Hosting region(s), e.g. an EU region for EU customers] | Used at launch |
| Paddle.com Market Limited (Paddle) | Billing: subscriptions, payments, invoices, VAT and sales tax, the customer portal. Paddle is the merchant of record and an independent controller of the payment data it collects. | Sent by Loopin: the workspace id, the plan and the number of seats; nothing about your people. Collected by Paddle at checkout: the payer’s name, email, billing address, tax number and card. Returned to Loopin: Paddle customer and subscription ids, status, price, quantity, period, card brand, last four digits and expiry, invoice numbers and totals. | UK, EU and US | Used at launch |
| Email provider [to be named before launch] | Sends sign-in codes, invitations, security notices and deletion notices. | Recipient address, name and the message (codes expire in minutes; no attachments). | [Provider region(s)] | Used at launch |
| Cloudflare, Inc. | DNS and proxy for our domain, and Turnstile, the bot check on our contact form. | Visitors’ IP addresses and request details (for Turnstile and the proxy). No workspace content. | Global | Used at launch |
| Google LLC, Firebase Cloud Messaging | Delivers push notifications to Android and web (and to iOS through Apple). | A device registration token and the notification’s title and short text (for example a chat message’s sender and a snippet, a task reminder’s title, a must-read announcement’s title). People who are online, have muted a chat or are in quiet hours are not sent a push. | Global | Optional, can be switched off |
| Apple Inc., Apple Push Notification service (through FCM) | Delivers push notifications to iPhones and iPads. | The same push payload. | Global | Used once the iOS app is released |
| Error-tracking provider [Sentry or self-hosted, to be decided] | Crash and error reports, so that we can fix faults. | Stack traces and request ids. Personal data is scrubbed before sending: no request bodies, tokens, codes or message text. | [EU / US, or our own servers if self-hosted] | Optional, to be decided before launch |
| Language-model provider [only if enabled] | Wording of answers in Ask Loopin and of workspace set-up proposals. | Only what the asking person may see, with email addresses, phone numbers and ids removed first; never other people’s tasks or direct chats. | [Provider region, or our own server] | Off by default; a rules engine answers instead |
Customers can be told when this list changes: write to [legal@your-domain] and ask to be on the notification list, or follow the process in your Data Processing Agreement.
Components Loopin runs itself
These run on Loopin’s own servers at the hosting provider above. They are not separate sub-processors.
| Component | What it does |
|---|---|
| PostgreSQL database | Holds the workspace data, with row-level security per workspace. |
| Redis-compatible cache (Valkey) | Rate limits, session revocation, queues and realtime delivery. No message text. |
| S3-compatible object storage | Uploaded files, short-lived data exports and payroll files, downloaded only through short-lived links. |
| Virus scanner (ClamAV) | Scans uploaded files. |
| LiveKit (open source) | Audio and video calls. Media passes through our server; nothing is recorded. |
| Face matching (open-source model, WebAssembly) | Compares a check-in selfie with the enrolled face inside our own server process. No outside service is called. |
What we do not use
- No advertising or page-tracking analytics on the website or in the app. The analytics owners see are computed inside their own workspace from its own data.
- No SMS or WhatsApp provider: people sign in with an emailed code or an invite code.
- No outside face-recognition service: face matching runs on our own servers.