Data Processing Addendum

1. Roles

You are the controller of the personal data described in this DPA: you decide to connect an account, what the assistant may say, and what happens to the messages and contacts. Looop is your processor and acts only on your instructions. Meta Platforms is not a party to this DPA: it provides the messaging platform under its own terms, and you have your own relationship with it.

2. What is processed

Subject matter and duration

Running your inbox and, if you turn it on, the AI assistant, for as long as you keep an account connected and until the retention periods in section 6 have run.

Nature and purpose

Receiving messages from Meta's APIs, storing and showing them in your inbox, sending your replies, generating and sending assistant replies, saving contacts who agree to hear from you, and notifying you by email. Nothing else.

Categories of data subjects

People who message your connected account, and people who leave contact details on your page.

Categories of personal data

• Message content (text and attachments), reactions, read receipts and timestamps.
• The sender's platform-scoped id, username, display name and profile photo.
• Contact details people give the assistant or your page: email address, name, and the consent wording and time.
• Delivery events Meta sends about the messages.

Messages may contain whatever people choose to write, which can include special categories of data (for example about health). The assistant is instructed to hand such topics to you rather than answer them, but Looop does not filter them out of storage.

3. Your instructions

Your instructions are these Terms, this DPA, the settings you choose in the Looop app (which accounts are connected, whether the assistant is on, draft or auto mode, what your page and FAQ say) and the actions you take in the inbox. We will tell you if we think an instruction breaks data protection law.

We will not use the personal data for our own purposes, to train any model, for advertising, or to message anyone on our own initiative.

4. Our obligations

• Confidentiality. Only staff who need access to run or support the Services can see your inbox data, and they are bound by confidentiality.
• Security. Encrypted connections (HTTPS), access tokens stored encrypted, per-page isolation so one creator can never see another's data, hashed identifiers towards the model provider, access controls, and logging. Message text is kept out of logs and assistant run records.
• Assistance. We help you answer data subject requests (access, correction, deletion, portability, objection) with the tools in the app and, where those are not enough, by email. We help with data protection impact assessments and consultations with authorities, as far as the information we hold allows.
• Breach notice. If we learn of a personal data breach affecting your data, we tell you without undue delay and in any case within 48 hours of becoming aware, with what we know and what we are doing.
• Audit. On request, no more than once a year unless an authority or a breach requires it, we provide the information needed to show we meet this DPA and allow an audit by you or an auditor you appoint, at reasonable notice and at your cost.

5. Subprocessors

You authorize us to use the subprocessors listed on our subprocessors page. We put each one under written terms at least as protective as this DPA and stay responsible for their work.

The page shows the current list. We will update it at least 30 days before a new subprocessor starts processing your data and notify you by email. If you object on reasonable data protection grounds and we cannot resolve it, you may disconnect the affected account or close your Looop account; that is your remedy.

The AI model providers (through OpenRouter) only process data when the assistant is turned on. Every request is routed only to endpoints with zero data retention, and the provider receives no identifier for the person who wrote the message.

6. Retention, deletion and return

We keep your inbox data only as long as needed to provide the Services:

• Conversations and messages: deleted 12 months after the last message in the conversation.
• Conversations of a disconnected account: deleted 30 days after the disconnect. The account's access token is deleted at once.
• Delivery events from Meta: deleted after 7 days.
• Assistant run records (model, tokens, cost, outcome; no message text): deleted after 90 days.

You can delete any conversation at any time and export your conversations and contacts from the app. When you delete your Looop account, everything is deleted after a 7-day grace period. When Meta tells us a person removed Looop from their account or asked for deletion, we delete that connection with all its conversations, messages and events and confirm it on a status page. Copies in backups are overwritten within 60 days.

7. International transfers

Looop hosts your data in the United States (Amazon Web Services, US East). Our subprocessors may process data in other countries, including the United States; the subprocessors page shows where. Where a transfer out of the EEA, UK or Switzerland needs a safeguard, we rely on the European Commission's Standard Contractual Clauses (processor-to-processor or controller-to-processor modules as applicable) and the UK International Data Transfer Addendum, or another lawful mechanism.

8. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms, this DPA wins for the processing it covers. If the law requires terms this DPA does not contain, the parties will agree them in good faith.

9. Contact

Data protection questions and requests: info@meetlooop.com. Our data protection contact is the Looop team at that address.