Privacy Policy

1. What we collect

We collect information you give us when you sign up: your name, email address, and password (stored as a one-way hash). When you hire an agent, we store the brief you provide (your product, ICP, tone preferences, etc.) so the agent can do its job.

We also collect standard usage data — pages visited, actions taken, timestamps — to improve the product and debug issues. Microsoft Clarity and the Meta Pixel, described in section 3, use cookies and similar technologies on our site and app.

2. How we use it

• To operate the service and run your AI agents
• To send transactional emails (receipts, agent updates, alerts)
• To process payments via Stripe (we never see your card details)
• To improve the product based on aggregate usage patterns
• To measure and improve our own advertising

We do not sell your data. We do not use your brief data to train shared models.

3. Third-party services

We use the following sub-processors. All are United States companies; where one processes your data outside the United States, that is noted against it.

• Cloudflare, Inc. — application hosting, database, job queue, object storage, DNS and CDN. Our production application and database run in eastern North America. An earlier copy of the database remains in Cloudflare's Asia-Pacific region until we delete it.
• Railway Corporation — hosting for the code repositories that hold agent workspace files, which may be stored in Railway's Southeast Asia (Singapore) region.
• OpenAI, L.L.C., Anthropic, PBC and Google LLC — AI inference. Your brief, and the message or comment an agent is replying to, are sent to whichever of these models is configured, for generation only; they are not used to train models.
• Microsoft Corporation — product analytics and session replay (Microsoft Clarity), which records how pages are used across the site and the app
• Meta Platforms, Inc. — advertising measurement (Meta Pixel), which tells Meta when pages across the site and the app are visited, so we can measure and target our own ads. This is separate from the Meta Platform Data in section 5, which is never used for advertising.
• Stripe, Inc. — payment processing
• Slack Technologies, LLC — agent notifications and conversations, where you connect Slack

4. Google user data (YouTube)

When you connect a YouTube channel, LoopTask uses the Google API Services described below. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access. With your permission we request two scopes: youtube.readonly, which lets us read your channel's name, ID, and the status of videos published through LoopTask; and youtube.upload, which lets us upload videos to your channel. We do not read your subscriptions, comments, watch history, or any video you did not publish through LoopTask.

How we use it. Solely to provide the feature you asked for: publishing the videos you or your agent schedule, and showing you their status inside the app. We do not use Google user data for advertising, and we do not use it to develop, improve, or train AI/ML models.

What we share. Nothing. Google user data is never sold, and never transferred to third parties — including data brokers, advertisers, or AI model providers — except where strictly required to operate the feature at your direction, or where the law requires it.

How we protect it. Google OAuth access and refresh tokens are encrypted at rest with AES-256 and are never written to logs. All traffic to and from Google APIs runs over TLS. Access is limited to the systems that publish your posts.

Retention and deletion. We keep your Google tokens only while the channel is connected. Disconnecting the channel on the Integrations page revokes the token with Google and deletes it from our database immediately. Deleting your LoopTask account removes all remaining Google user data within 30 days. You can also revoke LoopTask's access at any time from your Google Account permissions page.

5. Meta Platform Data (Facebook, Instagram, Threads)

When you connect a Facebook Page, Instagram business account, or Threads profile, LoopTask acts on that account on your behalf. We handle the data Meta makes available to us in line with Meta's Platform Terms and Developer Policies.

What we access. The list of Pages and Instagram accounts you administer, so you can choose which to connect; the posts published through LoopTask; comments, mentions and direct messages received on those accounts; and post and account metrics such as views and reach. We do not read your personal Facebook profile, your friends, or content on accounts you have not connected.

How we use it. Solely to provide the features you asked for: publishing the posts you or your agent approve, showing comments and messages in your inbox so you can reply, and displaying performance metrics. We do not use Meta Platform Data for advertising, and we do not use it to train AI models.

What we share. Nothing is sold or shared with data brokers or advertisers. The only third parties involved are the sub-processors listed in section 3, acting under contract on our instructions.

How we keep customers separate. Every connected account, post, comment and message is stored against the organisation that connected it, and every query is scoped to that organisation. One customer's data is never visible to another.

How we protect it. Access tokens are encrypted at rest with AES-256-GCM and are never written to logs. All traffic to and from Meta's APIs runs over TLS.

Retention and deletion. We keep tokens only while the account is connected. Disconnecting on the Integrations page revokes the token with Meta and deletes it from our database immediately. Deleting a comment or message from your LoopTask inbox removes our stored copy only — it does not delete anything on Facebook or Instagram. Moderating a comment is different and is labelled as such: the “Hide on Facebook”, “Hide on Instagram”, “Delete on Facebook” and “Delete on Instagram” actions do act on the network itself, hiding or permanently deleting that comment on your own post. Only a person can use them; your agent can draft a reply but cannot hide or delete anything. Deleting your LoopTask account removes all associated Meta Platform Data within 30 days. You can also remove LoopTask at any time from your Facebook apps and websites settings, or request deletion by emailing privacy@looptask.ai with the connected account name; we confirm completion by email within 30 days.

6. Data retention

We keep your data while your account is active. If you cancel, we delete your account data within 30 days on request. Agent message logs are retained for 90 days.

7. Security

Passwords are hashed with bcrypt. OAuth tokens are encrypted at rest. All data is transmitted over TLS. We do not log passwords or raw credentials.

8. Government and law enforcement requests

We do not give any government or public authority access to your data except where we are legally required to. When we receive such a request:

• We review whether the request is lawful and properly issued before responding, and reject requests that are not.
• We disclose only the minimum information the request actually requires — never a whole account or database because it was easier.
• We keep a written record of each request, what we disclosed, the legal basis, and who decided.

Where the law allows it, we will tell the affected customer before disclosing anything.

9. Your rights

You can request a copy of your data, ask us to delete it, or update it at any time. Email us at privacy@looptask.ai.

10. Changes

We may update this policy. Material changes will be emailed to active users at least 14 days before they take effect.

11. Contact

Questions? privacy@looptask.ai