Concept site: Loomwork, Inc. is fictional, and the company details are placeholders (addresses and emails use the reserved .example domain). On a real site, every page is filled with the real business details and reviewed by a lawyer in the business's country.
Privacy Policy
Last updated: 17 October 2026
This policy explains what personal data Loomwork, Inc. collects, why, how long we keep it and what you can ask us to do with it. We wrote it to be read, not to be skimmed past.
1. Who we are
Loomwork, Inc., 100 Example Street, Suite 1, San Francisco, CA 94100, USA ("we") is the controller of the personal data described here. Questions: privacy@loomwork.example.
Our representative in the EU: Loomwork EU Representative, Example Plein 1, 1000 AA Amsterdam, Netherlands (placeholder, GDPR Art. 27).
Our representative in the UK: Loomwork UK Representative, 1 Example Road, London EC1A 1AA, United Kingdom (placeholder, UK GDPR Art. 27).
2. What we collect and why
We only collect what we need for the purposes below. We don't buy data about you and we don't sell or rent it to anyone.
| What | Data | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account | work email, name, company, role, password hash | to create and run your workspace | contract |
| Billing | billing contact, plan, invoices (card data is handled only by our payment provider) | to charge and invoice you | contract, legal obligation |
| Customer content | invoices, POs, ledger data and approvals your team puts into Loomwork | to run your workflows, as your processor | your instructions (see the DPA) |
| Usage | log-in times, feature use, error logs, IP address | to keep the service secure and working | legitimate interest |
| Marketing | email address, only if you opted in | to send product news | consent |
| Privacy requests | name, email, request type, your message | to answer and document your request | legal obligation |
| Accounting | invoices and payment records | to keep the tax records the law requires | legal obligation (kept 7 years) |
Do you have to give it? You need an email address to create a workspace and billing details to pay for a plan. Everything else is optional. We don't make decisions about you based solely on automated processing.
When your team puts business data into Loomwork, your company is the controller and we are the processor. That data is covered by our Data Processing Addendum, not by this policy.
3. Who we share it with
Service providers that help us run the business, under written contracts that let them use the data only for our instructions: cloud hosting (EU or US region), email delivery, payment processing, customer support tooling, and the AI model provider used by the agents. We may also share data when the law requires it, or to protect our rights in a dispute.
4. International transfers
We are based in the USA, so your data is processed in the US by us and by our providers. For data from the EU/EEA, UK and Switzerland we rely on the EU-US Data Privacy Framework (certification to confirm) and on the European Commission's Standard Contractual Clauses with the UK addendum.
5. How long we keep it
Account data: while you are a customer, then up to 12 months unless the law asks for longer. Invoices and payment records: 7 years. Marketing: until you opt out. Server logs: 30 days. Then we delete or anonymise it.
6. Your rights
Wherever you live, you can ask us to:
- See the data we hold about you and get a copy (access, portability).
- Correct it if it's wrong.
- Delete it ("right to be forgotten"), unless we must keep it by law.
- Stop or limit how we use it, or object to it.
- Withdraw consent at any time, for example by unsubscribing from emails with the link in every email.
We reply within one month (GDPR), or 45 days for California requests. It's free. If you're not happy with our answer, you can complain to the data protection authority of your EU/EEA country, or the UK ICO.
California residents (CCPA/CPRA): we don't sell or "share" personal information for cross-context advertising, and we don't use sensitive personal information to infer characteristics. You can make the same requests as above, and we won't treat you differently for using your rights. We honour the Global Privacy Control signal.
Israel: requests under the Protection of Privacy Law are handled the same way.
7. Children
This site is not for children under 16 and we don't knowingly collect their data. If you think a child gave us data, write to us and we will delete it.
8. Security
Encryption in transit (HTTPS), access only for staff who need it, and payment details handled only by a certified (PCI DSS) payment provider. If a breach puts your data at risk, we will tell you and the authority as the law requires.
9. Cookies
See our Cookie Policy. You can change your choice any time with Cookie settings.
10. Changes
If we change this policy in a way that matters, we'll say so on the site and, if you're a customer, by email, before the change applies.
11. Make a privacy request
Use this form, or write to privacy@loomwork.example. We'll confirm it's you before we act, using the email address on your account or order.