Privacy notice

This notice covers https://looptake.com, the Looptake application for AI short-form video generation and auto-posting, client review pages and reports, the REST API, the command line tool (CLI) and the MCP server. It explains what personal data is processed, why, who else handles it, how long it is kept, and what you can ask us to do about it.

For your account, your team and your billing we are the controller: we decide what is collected and for what purpose. For the content inside a workspace, including prompts, uploads, a crawl of your website, brand kits, client feedback and the media generated from them, we are the processor and you are the controller. An agency that runs workspaces for its clients is the controller toward those clients. If personal data about somebody else ends up in a workspace because you put it there, it stays yours and we act on your instructions with it.

If you need a data processing agreement, or a copy of ours, write to privacy@looptake.com and we will put one in place.

Each row is a category of data, the reason it exists, the lawful basis we rely on under the UK GDPR and the EU GDPR, and the point at which it is deleted. Where a basis is legitimate interests, the interest is named so you can weigh it and object.

Three rows above end at a workspace, so it is worth being exact about what happens to one. A workspace can be archived, which hides it and stops it being used, and archiving deletes nothing and can be undone. There is no workspace delete in the product, so removing what a workspace holds is a request under Your rights rather than a button, and it is one we act on.

We do not run advertising, we do not sell or share personal information, and there is no third-party analytics or advertising script anywhere on this site or in the application.

We do not use your content, your uploads or your brand context to train models, and our providers are contracted not to train on them either.

No decision producing a legal or similarly significant effect on a person is made about anyone by automated means. Generating a video is not such a decision; suspending an account is, and a person makes that one.

See: The agreement these obligations sit under

You connect an account on the platform’s own screen. We never see your platform password. The scopes below are the whole request, and each one is there because a feature you can see would not work without it.

Google scopes are shown by their short name; each is the corresponding googleapis.com authorisation scope. We do not ask for permission to read your inbox, your followers’ data, your direct messages, or posts we did not publish.

You can withdraw any of it at any time, by disconnecting the account here or revoking access in the platform’s own settings. Either stops future posts. Neither deletes posts already published, because those live on your account at the platform and belong to you.

If a token expires or is revoked, scheduled posts to that account fail and we tell you which account needs reconnecting. We do not retry silently and we do not hold a copy of a token after you disconnect.

See: How TikTok publishing works · How Instagram publishing works · How YouTube publishing works

The architecture implies a small number of processors, listed here by the role they play. Each is under a written contract that limits it to our documented instructions, requires confidentiality and appropriate technical measures, and forbids training on customer content.

The current list, with each processor’s name and the country it operates from, is available from privacy@looptake.com on request. We announce a new processor that will handle customer content at least 30 days before it starts, so there is time to object.

We disclose personal data outside this list only where the law requires it, and where we are allowed to tell you that we have, we will.

See: What Looptake connects to

Some of these processors operate outside the country you are in, including in the United States.

Where personal data leaves the UK or the EEA, the transfer is covered by an adequacy decision where one applies, and otherwise by the European Commission’s standard contractual clauses together with the UK international data transfer addendum, plus whatever supplementary measures the transfer risk assessment calls for. A copy of the clauses we rely on is available from privacy@looptake.com.

One cookie does real work: the session cookie set when you sign in. It carries an opaque random token, it is HttpOnly, Secure and SameSite=Lax, and it exists so the application knows you are signed in. It is strictly necessary, which is why there is no consent banner: there is nothing here to consent to.

A theme preference may be stored in your browser. It never leaves it and it is not personal data to us.

There are no advertising cookies, no cross-site tracking, no tag manager and no third-party analytics. The site’s content security policy blocks third-party script outright, so this is enforced by the server rather than promised by a page.

Security is a design decision here rather than a policy document, so this section names the mechanisms:

• Passwords are hashed with Argon2id. Nobody at this company can read yours.
• Sessions are opaque random tokens, stored hashed, in an HttpOnly, Secure, SameSite=Lax cookie.
• Two-factor authentication is available on every account and uses time-based one-time codes.
• API keys are shown once and stored as a SHA-256 hash, and each key carries scopes so it can only do the job it was made for.
• Platform access and refresh tokens are encrypted at rest.
• Every tenant table enforces row-level security keyed to your team. A query that arrives without a team scope fails rather than returning somebody else’s rows.
• Traffic is TLS only, and the site sends HTTP Strict Transport Security.

If you find a vulnerability, report it to security@looptake.com. The disclosure policy and contact are also published at /.well-known/security.txt.

If a breach affects personal data we hold, we notify the supervisory authority within 72 hours where the law requires it, and we tell affected people without undue delay where the risk to them is high. If you are the controller and it happened in your workspace, we tell you first so you can meet your own deadline.

See: How keys and scopes work

Depending on where you live, you have some or all of these rights: to get a copy of your data, to have it corrected, to have it deleted, to restrict or object to processing, to receive it in a portable format, and to withdraw consent where consent is what we relied on.

One of them is a button rather than a request: account settings closes your account, and you do not need our permission for it. What it removes is you, in the terms the first row of the table above sets out, and not the team or what the team holds. The billing screen shows your plan, your balance and every credit movement, and it has no invoice download. There is no workspace export either. The one file this product hands over by itself is a CSV of how your posts performed, which the analytics screen, the API and the command line tool all serve, and the rest of a workspace is readable through the API a resource at a time. For a copy of anything else, including your brand context, your decks and your generated media, write to privacy@looptake.com and a person assembles it inside the deadlines below.

For anything else, write to privacy@looptake.com from the address on the account. We acknowledge a request within 3 days and aim to complete it within 21 days. Those are our targets, and they sit inside the statutory limits: one calendar month where the GDPR applies, and 45 days where the CCPA applies. Where a request is complex enough to need an extension the law allows, we tell you before the deadline rather than after it.

We may ask you to confirm who you are before we act, because handing an export to the wrong person is the exact failure this process exists to prevent. We do not charge for a request unless it is manifestly unfounded or excessive, and we would tell you that before doing anything.

Where we are the processor rather than the controller, for example when the request is about a person whose data sits in your workspace because you put it there, we pass it to you and help you answer it.

If you are in California: we do not sell or share personal information, and we have not done so in the preceding twelve months. You have the right to know, to delete, to correct, to limit the use of sensitive information, and not to be treated differently for exercising any of them.

You can complain to a supervisory authority at any time. In the UK that is the Information Commissioner’s Office; in the EEA it is the authority where you live or work. We would rather you told us first, and we will still tell you where to go if we cannot resolve it.

This is a business tool. It is not directed at children, we do not knowingly collect data from anyone below the minimum age set out in the Terms, and we do not build profiles of anyone under that age.

If you believe a child has an account here, write to privacy@looptake.com and we will close it and delete the data.

See: Eligibility and minimum age

This page is the current notice. The date at the top is the date it last changed, and there is no other version in force.

A material change, meaning one that changes what we process, why, who else handles it or how long it is kept, is announced at least 30 days before it takes effect, by email to the team owner and on this page. A clarification or a corrected address takes effect when it is published.

Where a change requires your consent, we ask for it rather than assuming it from continued use.

Privacy requests, data processing agreements, sub-processor lists and transfer documentation: privacy@looptake.com.

Everything else, including billing and account questions: support@looptake.com.

Vulnerability reports: security@looptake.com, with the policy published at /.well-known/security.txt.

A postal address for formal correspondence is provided on request, and appears on every invoice.