Privacy Policy

Last updated: April 2026

This Privacy Policy describes how Looma ("we", "us", "our") collects, uses, and protects your personal data when you use our platform at looma.chat and related services.

1. Data We Collect

We collect the following categories of data:

• Account data — name, email address, password (hashed), language preference, and timezone when you register.
• Site data — your website URL, product catalog data (imported from XML/CSV feeds), and AI-generated product descriptions.
• Chat data — messages exchanged between your website visitors and the AI assistant or human agents, including visitor IP addresses and browser user-agent strings.
• Search data — search queries made by visitors through the search widget.
• Usage analytics — pages visited, features used, widget interactions, and session duration within the Looma dashboard.
• Payment data — subscription plan, billing history, and payment method details (processed and stored by our payment provider; we do not store full card numbers).
• Channel data — when you connect Telegram, Viber, Facebook Messenger, Instagram, or email channels, we process messages routed through those integrations.

2. How We Use Your Data

We use collected data to:

• Provide, operate, and maintain the Looma platform and widgets.
• Generate AI-powered responses and product recommendations using your product catalog and chat context.
• Power semantic search across your product catalog using vector embeddings.
• Improve our services, fix bugs, and develop new features.
• Send transactional emails (account confirmation, password reset, balance alerts) and, with your consent, product updates.
• Detect fraud, prevent abuse, and maintain platform security.
• Process payments and manage your subscription.

3. Data Storage and Security

Your data is stored on servers located in Europe. We use industry-standard security measures including encrypted connections (TLS), hashed passwords, CSRF protection, and role-based access control. Product embeddings and search indices are stored in OpenSearch with access restricted to authorized services only.

• We retain your data for as long as your account is active. Chat messages and visitor events are retained for 12 months after the last activity. You may request earlier deletion at any time.

4. Third-Party Services

We share data with the following third-party services strictly as needed to provide our platform. We never sell your personal data or any platform data to third parties:

• OpenAI — chat messages and product data are sent to OpenAI API for AI response generation. OpenAI processes this data according to their API data usage policy and does not use it for model training.
• Meta (Facebook & Instagram) — when you connect Messenger or Instagram channels, messages are routed through Meta's Graph API. We use this Meta Platform Data solely to deliver the messaging service on your behalf, in compliance with Meta's Platform Terms and Developer Policies, and never for any other purpose.
• Telegram — when you connect a Telegram bot, messages are routed through the Telegram Bot API.
• Viber — when you connect a Viber channel, messages are routed through the Viber REST API.
• Payment provider — subscription and payment data is processed by our payment provider. We do not store full payment card details on our servers.
• Mailgun — used for sending and receiving emails through the email channel feature.
• Google — OAuth authentication (optional) and Google Sheets/Docs integration for knowledge base sources.

5. Cookies

We use essential cookies required for authentication and session management. The Looma widget uses a session cookie to maintain chat continuity for visitors. We do not use third-party tracking cookies or advertising cookies.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right of access — request a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data.
• Self-service deletion — you can delete your account and all associated data yourself at any time in your profile settings (Profile → Delete account); deletion is permanent.
• Right to data portability — receive your data in a machine-readable format.
• Right to restriction — request that we limit processing of your data.
• Right to object — object to processing of your data for certain purposes.
• Right to withdraw consent — withdraw your consent at any time where processing is based on consent.
• To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Children's Privacy

Looma is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on our website. Continued use of our services after changes constitutes acceptance.

9. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

• Email: [email protected]