Privacy Policy

1. Who we are

wwworks AB (reg. no. 559XXX-XXXX), Street 1, 111 11 Stockholm, Sweden, is the controller of the personal data described in this policy, except where section 2 says we act for a customer.

Questions and requests about personal data: hello@example.com.

2. Our two roles

• As controller, we handle data about the people who use LOOPS for our customers, visitors to our website, newsletter subscribers and anyone who contacts us. This policy covers that data.
• As processor, we handle personal data for our customers: data in the ad accounts they connect, and the purchase events their online shops send us (section 5). The customer is the controller of that data, and its own privacy policy applies. Our data processing terms set out how we handle it.

If you shop with one of our customers and want to exercise your rights, contact that business. We’ll help them respond.

3. What we collect and why

We collect data you give us, data created when you use LOOPS, and data from the services you connect.

You don’t have to give us personal data, but we can’t provide LOOPS without account and billing data. Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 12).

4. Data from your ad platforms and store

When you connect an advertising platform, you choose the accounts to share and approve the permissions below. We ask only for what LOOPS needs, and we use the data only to provide LOOPS to you: to read results, decide and apply budgets, create and publish ads, and report what we did.

We don’t sell platform data, use it to profile or target individuals, use one customer’s data for another customer, or use it to train AI models. We share it only with the service providers in section 8 that need it to run LOOPS. Access tokens are encrypted with AES-256, and all data travels over TLS 1.2 or higher (section 10).

Meta (Facebook and Instagram)

Through Facebook Login for Business you grant these permissions for the business assets you select:

• ads_management: to change budgets and the account spending limit, pause and resume ads, create ads and send purchase events to your dataset.
• ads_read: to read your ad accounts, campaigns, ad sets, ads and their results.
• business_management: to reach the ad accounts, Pages and datasets you share from your business portfolio.
• pages_show_list: to list the Pages you can advertise as.
• pages_manage_ads: to publish ads as your Page.
• pages_read_engagement: to read your Page's name and the posts used in your ads.

We receive and store the ID of the Meta user or system user that authorizes us, the permissions granted and an encrypted access token. For the assets you share we store ad account details (name, currency, time zone, status, spending limit and amount spent); campaigns, ad sets and ads with their names, status and budgets; ad creatives (text, images, links and the Page they run as); and results such as spend, impressions, clicks, conversions and conversion value.

We keep this data while the connection is active. When you remove LOOPS in Meta, ask us to disconnect or close your account, we delete the access token and the data we received from Meta within 30 days, except aggregated figures that can’t identify you or anyone else. See Delete your data.

Google

Sign in with Google. If you choose it, we receive your name, email address and profile picture from Google through our sign-in provider, Clerk. We use them only to create your account and sign you in, and delete them with your account.

Google Ads (coming soon). When you connect Google Ads, you grant access to manage your Google Ads accounts (scope https://www.googleapis.com/auth/adwords). We read account details (ID, name, currency and time zone), campaigns, ad groups, ads, budgets and performance reports, and change budgets, status and ads as described above. If you turn on conversion tracking through LOOPS, we send your shop’s purchase events to your Google Ads account with email addresses and phone numbers hashed. We keep Google Ads data while connected and delete it within 30 days after you disconnect or close your account.

That means we use Google user data only to provide and improve the features you use in LOOPS. We don’t transfer it except as needed for those features, to comply with law or as part of a merger or acquisition. We don’t use it for advertising, sell it, or use it to develop, improve or train generalized AI or machine learning models. No one at wwworks AB reads it unless you ask us to, it’s needed for security, or the law requires it. You can revoke access at any time under Third-party apps & services in your Google Account.

TikTok (coming soon)

When you connect TikTok for Business, you authorize access to the advertiser accounts you choose. We read account details, campaigns, ad groups, ads, budgets and reports, and change budgets, status and ads as described above. If you turn it on, we send your shop’s purchase events to your TikTok pixel through the Events API, with email addresses and phone numbers hashed. We keep TikTok data while connected and delete it within 30 days after you disconnect or close your account. You can revoke our access in TikTok for Business at any time.

Shopify

When you connect your Shopify store, you approve access to read your products (read_products) and to add the LOOPS pixel to your store (write_pixels, read_customer_events). We store an encrypted access token and your store’s name, myshopify.com address and currency, and copy your active products: names, descriptions, prices, links, vendor, type and images, and each product’s cost where your store allows apps to see it. The AI uses them to write about your real products, and their photos can become ad images. Costs are used to work out your margins when your goal is profit. We don’t read your orders or your customer list.

If you turn on purchase tracking, the LOOPS pixel sends each completed checkout to us as described in section 5. Shopify runs the pixel only for shoppers who allowed analytics and marketing in your store’s cookie settings.

We keep your products while the store is connected and update them every night. When you disconnect, we delete them at once; if you remove the app in Shopify, tracking stops at once, and when Shopify asks us 48 hours later to delete the store’s data, we delete it right away.

5. Server-side events from your shop

Browsers increasingly block tracking, so a customer’s online shop can send purchase and other events to LOOPS server to server. We pass them on to the customer’s own dataset at Meta and, when available, Google and TikTok.

An event can contain a shopper’s email address, phone number, customer ID, IP address, browser user agent, Meta click and browser IDs, the page, and the purchase (products, value and currency). Before forwarding, we hash the email address, phone number and customer ID with SHA-256, as the platforms require. We don’t store the shopper’s personal data: we keep only the event’s ID, name, time and value, to avoid counting a purchase twice and to show results.

For Shopify stores with purchase tracking on, the LOOPS pixel sends the event from the shopper’s browser after checkout, including the Meta browser and click IDs stored in the shop’s own cookies and the IP address the request comes from. Email and phone are included only where Shopify has approved our access to protected customer data.

We do this as the shop’s processor. The shop decides what to send and must have a legal basis for it, such as consent to marketing cookies where the law requires it. Shoppers should contact the shop about their data.

6. AI and automated decisions

We use Claude, an AI model from Anthropic, to write and revise ad copy. It receives product information, the text of your best-performing ads, your brand voice, the instructions you give when you revise an ad, and the images and PDFs in your library. When you give us your website, Claude reads its public pages through Anthropic’s web fetch, limited to your site’s own domain, and we keep a summary of what it learned. When you import from a web page, our servers download the files you choose. Library photos can show people; the rest isn’t meant to contain personal data. Anthropic processes it as our service provider and, under its commercial terms, doesn’t use it to train its models.

LOOPS decides automatically how to split your budget between ads and when to pause one. These are decisions about ads, not about people: they have no legal or similarly significant effect on anyone, so the GDPR rules on automated individual decisions (Art. 22) don’t apply. Every decision is logged with its reasons, and you can pause any ad yourself.

7. Who we share data with

• Service providers that run parts of LOOPS for us (section 8). They may use the data only on our instructions and must protect it.
• Advertising platforms you connect: on your instruction we send budgets, ads (including the images and videos of ads you add yourself) and events to Meta and, when available, Google and TikTok. What a platform does with that data is governed by your agreement with it and its privacy policy.
• Stripe, which handles payments as our provider and, for fraud prevention and financial regulation, as an independent controller under its own privacy policy.
• Google, as an independent controller, if you sign in with Google.
• Authorities and courts, when the law requires it.
• A buyer or successor, if all or part of our business is sold or merged. This policy continues to apply to your data.

We don’t sell personal data, and we don’t share it for cross-context behavioral advertising.

8. Service providers

These providers process personal data for us. The list is also the subprocessor list for data we process for customers, who get notice before it changes (see the data processing terms).

9. Transfers outside the EU

We keep data in the EU where we can. Some providers in section 8 are in the USA or have staff there. For those transfers we rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses, with additional safeguards such as encryption. Data from the UK and Switzerland is covered by the UK Addendum and the Swiss adaptations of those clauses. You can ask us for a copy of the safeguards.

10. How we protect data

• Data is encrypted in transit (TLS 1.2 or higher) and at rest.
• Access tokens for advertising platforms are encrypted with AES-256 using keys held in AWS KMS in Stockholm, and each token can be decrypted only for its own customer and connection.
• Keys that shops use to send events are shown once and stored only as a hash.
• Library files and the files of your own ads are stored privately in Stockholm, encrypted, and shown only to your team. Invitation links are stored only as a hash.
• Error reports never include request contents, cookies or user details.
• Only people who need access have it, protected by two-factor authentication, and we review it regularly.
• Backups are encrypted and kept for up to 30 days.
• If a personal data breach occurs, we notify the supervisory authority within 72 hours where required, and the people affected without undue delay if it puts them at high risk.

11. How long we keep data

We keep personal data only as long as the purposes in section 3 require. In short:

• Account, ad platform, product and activity data: while your account exists, deleted within 30 days after it closes.
• Invoices and accounting records: until the end of the seventh year after the financial year, as the Swedish Bookkeeping Act requires.
• Newsletter: until you unsubscribe.
• Error reports: 90 days. Hosting logs: up to 30 days.
• Usage analytics: up to seven years, in a form that can’t be linked to you.
• Deleted data can remain in encrypted backups for up to 30 days.

Aggregated data that can’t identify anyone may be kept longer.

12. Your rights

You have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• receive it in a machine-readable format and have it transferred to another service;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing before you withdrew it.

Email hello@example.com. It’s free. We reply within one month; if a request is complex, we may need two more months and will tell you why. We may ask you to confirm your identity.

You can also complain to a supervisory authority: in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se), or the authority where you live or work, such as the ICO in the UK or the FDPIC in Switzerland. We’d appreciate the chance to put things right with you first.

These rights apply to everyone who uses LOOPS, wherever you are. If the law where you live gives you further rights, as some US state laws do, we honor those too.

13. Delete your data

You can have us delete your data at any time, including everything we received from Meta, Google or TikTok:

Removing our access stops LOOPS from reading or changing anything straight away. Ads and settings already in your ad accounts stay there; they’re yours.

14. Cookies

We use only cookies that are strictly necessary for the service you ask for. We don’t use advertising or cross-site tracking cookies.

Our analytics (PostHog and Vercel Web Analytics) and error monitoring (Sentry) don’t set cookies or store anything on your device.

15. Children

LOOPS is a service for businesses and isn’t meant for anyone under 18. We don’t knowingly collect data about children.

16. Changes to this policy

We update this policy when our processing changes; the date at the top shows the current version. Before material changes take effect, we tell customers by email or in the app.

17. Contact

wwworks AB, reg. no. 559XXX-XXXX
Street 1, 111 11 Stockholm, Sweden
hello@example.com