Scope and roles
This policy explains how Loop collects and uses personal data when someone visits uploadingloop.com, creates a Loop account, receives a document request, uploads a file, or contacts us.
For account, website, security, and support data, Loop decides why and how that information is processed. For recipient information and documents handled on a workspace user’s instructions, that workspace user normally controls the purpose of the collection and Loop acts as its service provider or processor.
Data we handle
Depending on how the service is used, we process:
- Account data: name, email address, password credentials handled by our authentication provider, and optional workspace name.
- Request data: recipient name and email, checklist items, due dates, instructions, review decisions, and request status.
- Uploaded content: documents, filenames, file types, file sizes, and upload timestamps submitted through a secure request link.
- Service activity: reminder history, delivery or bounce events, review activity, and security or operational records.
- Technical data: essential session cookies and network or diagnostic information processed by our hosting and infrastructure providers.
Documents can contain sensitive information. Workspace users should request only what they genuinely need and have a lawful reason to collect.
How we use data
We use personal data to operate the service, authenticate users, create secure request links, store and deliver documents, send requested reminders and status messages, prevent misuse, provide support, maintain audit history, and comply with legal obligations.
Our legal grounds may include performing a contract, legitimate interests in operating and securing the service, consent where required, and compliance with law. A workspace user is responsible for establishing its own lawful basis for the client or recipient data it asks Loop to process.
We do not sell personal data or use uploaded documents for advertising.
Service providers and transfers
We use specialist providers to run Loop, currently including Vercel for application hosting, Supabase for authentication, database and private file storage, Cloudflare for scheduled reminder execution, and Resend for transactional email when live delivery is enabled.
These providers process information only to supply their services to us and may operate in countries different from yours. Where required, we rely on appropriate contractual or legal safeguards for international transfers.
We may also disclose information when required by law, to protect people or the service, or as part of a business transfer subject to appropriate confidentiality protections.
Security and access
Loop uses HTTPS, authenticated workspace access, private file storage, short-lived signed file links, scoped recipient links, server-side secrets, and audit records. Recipient links do not require an account, so recipients should keep them private and avoid forwarding them.
No online service can guarantee absolute security. If you believe a request link, account, or document has been exposed, contact us promptly at security@uploadingloop.com.
Retention and deletion
We retain account and request data while needed to provide the service, maintain security and audit history, resolve disputes, and meet legal obligations. Replaced files are removed from active use. Infrastructure backups and limited security records may remain for a reasonable period before deletion or expiry.
Workspace users should establish retention periods suitable for the documents they collect. Account holders and recipients may request access, correction, export, or deletion by emailing privacy@uploadingloop.com. We may need to verify identity and coordinate recipient requests with the workspace user that initiated the collection.
Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, withdraw consent, or complain to a data protection authority. These rights can be limited by law and by the role Loop plays for a workspace user.
Loop currently uses only cookies and similar storage needed for authentication, security, and core service operation. We will update this policy before introducing non-essential analytics or advertising technologies.
Children, changes, and contact
Loop is a work-oriented service and is not intended for children under 18. Workspace users must not intentionally use Loop to collect children’s data without appropriate authority and safeguards.
We may update this policy as the product, providers, or legal requirements change. Material changes will be communicated through the service or by email where appropriate.
Questions or privacy requests can be sent to privacy@uploadingloop.com.