Privacy Policy

Loom is the seller and data controller for account administration and operation of this service. For personal data you upload about clients or colleagues, your organization may be the controller and Loom acts on its behalf to provide the requested service. You are responsible for having a lawful basis to share that information.

Our address is Maxine Court, Victoria, Australia. Contact us at agencyos.support@gmail.com for privacy questions or requests.

Account and contact data: email, account identifier, authentication information, profile details and workspace preferences support registration, sign-in, account management and service delivery. Agency membership and invitation email addresses enable shared workspace access.

Workspace content: client names and contact details, notes, tasks, meetings and transcripts, uploaded files and images, extracted document text, Assistant threads, prompts and answers are stored and processed to provide the features you use. Agency records are available to authorized agency members; connected-service credentials remain personal to the connecting user.

Connected services: when you authorize Gmail or Slack and enable them as sources, we process permitted account identifiers, email or channel/message data and access credentials to retrieve relevant context or prepare actions you review. Other integration cards are Coming soon, not current connection offers; existing saved connections are preserved.

Subscription and operational data: subscription identifiers, plan status, member/client counts and per-member AI usage support billing and plan limits. Hosting and service operations may process IP addresses, device/request information and error logs for reliability and security. Support messages, if submitted, are used to respond to your request.

Where applicable, account and feature processing is necessary to perform our contract with you; reliability, security and fraud prevention rely on legitimate interests; records required by law rely on legal obligations. Optional processing requiring consent will rely on that consent. Connecting an account authorizes the access you select and can be revoked.

We do not use this notice as consent for advertising or marketing. Where separate consent is required, processing must be based on that consent, and you may withdraw it by contacting us.

Assistant answers and meeting summaries use Lovable AI with an OpenAI model. Relevant prompts, conversation history and selected workspace or connected-source context are sent for processing. Client mode is limited to the selected client; Company mode may use agency records; General mode excludes workspace context.

Supported PDFs, office documents and images are sent through Lovable’s connector service to LlamaCloud/LlamaParse for text extraction, including scanned content where supported. Plain-text formats are read without that document service. Originals and extracted text are retained in Loom. After successful extraction, the app attempts to delete the external processing job; deletion is best-effort, not a guaranteed provider retention period.

Existing user-configured Anthropic credentials may route Assistant processing to Anthropic. The Claude connection card is currently Coming soon; this is not an offer of a new working Claude connection.

AI outputs may contain mistakes. We do not claim that provider processing is anonymous, that providers never retain data or train models, or that the service has verified certifications. Provider retention and training practices are governed by the relevant provider’s terms; the application’s configuration alone does not guarantee deletion or exclusion from training.

Recipients include Lovable Cloud hosting, authentication and storage services; Lovable AI and the relevant AI provider; LlamaCloud/LlamaParse for document extraction; and authorized connected services such as Google/Gmail and Slack. These services receive information needed for the feature requested.

Paddle is our Merchant of Record and receives information for selling subscriptions, payment processing, subscription management, invoicing and tax compliance under its own privacy notice. Payment details entered in checkout are handled by Paddle; the app keeps subscription records rather than a card-number field.

Information may also be shared with professional legal/accounting advisers or authorities where legally required. You can contact us for information about providers involved in processing your data.

Our service providers may process information outside your country. The location depends on the provider and feature used. We take reasonable steps required by applicable Australian privacy law when disclosing information overseas. Where UK/EEA rules apply, relevant transfers require lawful safeguards such as adequacy decisions or Standard Contractual Clauses.

We do not promise Australian-only or regional-only processing, or claim a particular transfer agreement has been independently verified. Contact us for information about a specific transfer before uploading data subject to location restrictions.

The app retains workspace records, conversations, originals and extracted document text to provide the service. Canceling a subscription or removing a member does not delete the agency’s records. Deleting a client-file record removes its linked extraction cache; provider job cleanup and backup deletion may have separate behavior.

We keep personal data for as long as needed to provide your account and requested features, comply with legal obligations, resolve disputes and maintain security. When no longer needed, we delete or anonymize it, subject to applicable recordkeeping obligations and backup/provider retention cycles. We do not promise a fixed deletion deadline or immediate removal from backups.

To close your account or request deletion, email agencyos.support@gmail.com. We verify your identity and scope of authority before responding. Requests concerning shared client records may require coordination with your agency owner. There is no self-service account-erasure control; cancellation alone does not make an erasure request.

Loom uses browser storage for sign-in persistence, workspace preferences and sign-in navigation state. The checkout loads Paddle’s checkout script when payment is requested; its storage and cookies are governed by Paddle’s notices. We did not find an application-added advertising or marketing tracker in the inspected code.

Hosting logs or platform-level measurement may still apply. The app does not currently provide an analytics/marketing cookie preference control. Third-party checkout and hosting practices may differ from the app’s own browser storage. You can clear site storage using your browser settings; doing so may sign you out or reset preferences. Optional analytics or marketing cookies, if introduced, require appropriate notice and controls.

The implementation uses authenticated access controls, private file storage and encrypted connected-account credentials. These are protective measures, not a guarantee of absolute security or a claim of certification. We aim to use appropriate technical and organizational safeguards.

Depending on your law, you may request access, correction, erasure, restriction, portability or objection, and withdraw consent where it is the basis for processing. UK/EEA individuals may complain to their supervisory authority; applicable GDPR requests should receive a response within one month, subject to lawful extensions.

Send privacy requests or complaints to agencyos.support@gmail.com. We will assess them under applicable law. Australian users may also raise unresolved privacy complaints with the Office of the Australian Information Commissioner (OAIC), where its jurisdiction applies.