Privacy notice

Template — not legal advice. This text is a starting point written for LoopLab’s actual data flows. It must be reviewed and completed by counsel (company name, address, governing law, liability caps) before it is relied on.

1. Who we are

[Company legal name], [registered address], [company number] (“LoopLab”, “we”). Contact: [privacy@your-domain].

2. Two roles

For account data (people who sign up for or use LoopLab) we are the controller. For visitor data collected on our customers’ pages we are a processor acting on the customer’s instructions; see the DPA and how tracking works.

3. Account data we process

• Name, email address, password hash, workspace memberships and roles — to provide the service (contract).
• Billing details processed by Stripe — to take payment (contract, legal obligation).
• Security logs (sessions, audit log of changes) — to keep accounts safe (legitimate interest).
• Product usage of our own website, measured with LoopLab’s cookieless tracking — to improve the website (legitimate interest).

4. Sub-processors

5. Retention

Account data is kept while the account exists and deleted within [30] days after deletion, except billing records kept as required by law. Visitor data follows the customer’s plan retention (30–365 days for replays and raw events).

6. Your rights

Access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. Write to [privacy@your-domain]. If you are a visitor of one of our customers’ pages, contact that company first; we will assist them.

7. International transfers

[Describe the transfer mechanism, e.g. Standard Contractual Clauses, for transfers to the United States.]