Privacy Policy

We are committed to protecting your personal data and ensuring your right to privacy. This Privacy Policy outlines the types of personal information we might collect and how we use it.

We do not collect any personal data when you visit our website.

We set no cookies of our own. Cookies are stored on your device only if you open the support chat described below, and they are then set by that provider.

Our website contains links to other websites, specifically to rapidapi.com. Please note that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other site that collects personal data.

Our home page embeds a product video hosted on YouTube (Google Ireland Limited). We use a two-click approach: on page load, only a preview image served from our own server is loaded. A connection to YouTube is established only after you actively click the play button, at which point your IP address and browser information are transmitted to YouTube and data may be transferred to the United States. We use YouTube's privacy-enhanced mode (youtube-nocookie.com). The legal basis is your consent under Art. 6(1)(a) GDPR, given by clicking play; you can withdraw it at any time by reloading the page and not starting the video again. See policies.google.com/privacy for how Google processes this data.

We offer a support chat operated by tawk.to ltd. (187 East Warm Springs Rd, Las Vegas, NV 89119, USA). It uses the same two-click approach as the video: on page load only our own button is shown, and no request whatsoever goes to Tawk.to. The vendor's script is loaded only after you click that button, at which point your IP address, browser information and the page you are on are transmitted to Tawk.to, cookies and local storage entries are set on your device, and data may be transferred to the United States. Anything you then type into the chat, including a name or e-mail address you choose to provide, is processed there so that we can answer you. The legal basis is your consent under Art. 6(1)(a) GDPR, given by opening the chat; you can withdraw it at any time by reloading the page and not opening the chat again. See tawk.to/privacy-policy for how Tawk.to processes this data.

If you reach our website through a Google ad, Google appends a click identifier to the landing page address (the "gclid" parameter, or "wbraid" / "gbraid" on some devices). If you then use one of our forms, we store that identifier alongside your enquiry and transmit it to Google so that an enquiry can be attributed to the paid click. We also store which page the enquiry came from, plus the campaign, ad group and match type identifiers Google likewise passes in the address. We use neither cookies nor any other technology that stores or reads information on your device for this; the identifiers are read from the requested address only. No cross-device profile is created. The legal basis is your consent under Art. 6(1)(a) GDPR, given in the form; you can withdraw it at any time with effect for the future. Transmission to Google may involve processing in the United States. If you do not reach the site through an ad, no click identifier exists and none is transmitted.

This section is about our product, not this website. In the Loopthink platform an administrator can connect a Google account so that the company's own AI assistants can read reporting data. Nothing below happens unless somebody actively connects such an account.

What we access. With your permission we read Google Ads reporting data (campaign structure and performance figures) and Google Search Console data (search performance and submitted sitemaps), and only for the accounts and properties an administrator has explicitly enabled. Both connections are read-only: our client can reach a small fixed set of reporting endpoints and no others, so nothing in your Google accounts is created, changed or deleted. During sign-in we also receive your Google e-mail address and name, to record who granted the access.

What we do with it. The data is returned to the AI assistant your administrator connected, such as Claude or ChatGPT, in answer to a question somebody asked there. That assistant is operated by its own provider under its own terms, and sending the data on is the purpose of the connection. We use the data for nothing else.

What we store. We store the access granted to us, encrypted, so that reports can be fetched again without a new sign-in. We do not keep a copy of the reporting data itself. We do keep an audit record of every request: who asked, which account, the exact query sent to Google, how many rows came back and which fields were withheld. That record is what lets an administrator answer the question of what somebody actually read. Where a filter contains text, the audit record contains that text as well. Audit records are kept for 24 months.

How it is protected. The access granted to us is encrypted with a managed key before it is written, and it is never returned by our API, not even to the form that set it up. Traffic to and from Google runs over TLS. The platform runs in the AWS European Sovereign Cloud, in Germany. Who may use a connection is decided by the member groups an administrator assigns, and audit records are append-only: the platform's own permissions allow them to be written and read, not changed or removed.

How long we keep it and how to have it deleted. The granted access is kept until somebody removes it, and disconnecting or deleting the connection deletes it with immediate effect. Audit records are deleted automatically 24 months after the request they describe. We keep no copy of the reporting data itself, so there is nothing further to delete. Deleting your workspace removes its connections and their stored access; write to us at the address below if you want your audit records removed before the 24 months are up, and tell us which workspace they belong to.

Limited use. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, we do not use it for advertising, and we do not use it to train generally available machine learning models. Humans do not read it, except with your explicit permission for a support request you raised, or where the law requires it.

Withdrawing access. An administrator can disconnect or delete the connection in the platform at any time, which removes the stored access. You can also withdraw it directly at myaccount.google.com/permissions. Either way, no further data is read from that point on.

You have the right to request, correct, delete, or restrict your personal data. If you have any questions about our privacy practices or this policy, please contact us at info{at}technologycircle{dot}io.