Privacy

Loopberry is a product of Loopberry, LLC, 1301 N Broadway STE 92334, Los Angeles, CA 90012. We’re the data controller for the account information described below, and you can reach us any time at hello@loopberry.app.

This policy covers you — the brand operator with a Loopberry account — and separately the people who visit your store or pay you, if you connect Shopify or Stripe. Those are very different relationships, so we describe them separately below. For your store visitors and payers, you are the data controller and we act on your instructions as a processor.

• Your account. Your email address, your workspace name, and which workspaces you belong to. We sign you in with a magic link, so we never ask for or store a password.
• Your billing status.Your plan, whether your subscription is active, and the Stripe customer and subscription identifiers. Card details go straight to Stripe’s hosted checkout — they never touch our servers.
• Connected-account tokens.When you connect Google Analytics, Meta, TikTok, or Shopify, we store the access and refresh tokens that let us read your data. They are encrypted at rest with AES-256-GCM under a key held separately from the database. Stripe is the one exception: we store no token for it at all — only your connected Stripe account’s identifier, which is all Stripe’s own recommended integration pattern asks us to keep.
• What you create in the app. Campaigns, creative briefs, generation prompts, scheduled posts, and the settings you choose.

We only read what the scopes you grant allow, and only for the workspace you connected. Nothing is written back to your accounts except actions you explicitly ask for — publishing a post you scheduled, or applying a budget change you approved.

• Google Analytics 4. Aggregate metrics only — sessions, conversions, revenue, and landing-page performance. We never request user-level or individual-visitor GA4 data.
• Instagram and Meta.Your own organic posts and their per-post insights (reach, likes, comments, shares, saves), and your ad-account spend and performance. We do not collect your followers’ profiles, their messages, or their personal details.
• TikTok.Your creator profile basics, and — for videos published through Loopberry — that video’s own view and engagement counts. Ad spend, if you connect a TikTok advertiser account.
• Shopify. Order totals, currency, and timestamps. See the next section for what we strip out first.
• Stripe. Payment amounts, currency, and timestamps for the Stripe account you connect — never card numbers or other payment-method details, which stay with Stripe. See the next section for how, and whether, we can tie a payment to the ad click that preceded it.

This section describes, specifically, how Loopberry accesses, uses, stores, and shares data from your Google account — your Google user data.

• What we access. When you connect Google Analytics, you grant the read-only analytics.readonly scope. We use it solely to call the Google Analytics Data API and read aggregate metrics — sessions, conversions, revenue, page views, and landing-page performance — for the GA4 property you choose. We request no user-level or individual-visitor data, and we never write to, or delete anything in, your Google Analytics.
• How we use it. Only to provide the feature you connected it for: showing your own analytics back to you inside your Loopberry dashboard — charts, week-over-week changes, anomaly alerts, top-performing pages, and the suggested actions derived from them. We do not use Google user data for advertising, and we do not use it to train machine-learning or AI models.
• How we store it. The OAuth tokens that let us read your Analytics are encrypted at rest (AES-256-GCM) and scoped to your workspace. The metrics we read are stored per workspace so your week-over-week and year-over-year comparisons work. Disconnecting Google Analytics in the app deletes those tokens and asks Google to revoke our access.
• How we share it.We do not sell, rent, or trade your Google user data, and we do not share it with advertisers or pool it with any other customer’s data. We transfer it to no one except the infrastructure providers that run Loopberry for you (listed below), and only as needed to operate the service.

Loopberry’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect Shopify or Stripe, Loopberry can show you which ad clicks actually preceded orders. This is a deliberately narrow, deterministic join — not an identity graph, and not a cross-site tracking network. We do not build profiles of your shoppers, and we do not share or combine data between different Loopberry customers.

Our first-party pixel runs on your storefront and is gated on your store’s consent banner. If Shopify reports no analytics or marketing consent — or reports nothing at all — the pixel sends us nothing. It also stays quiet on ordinary visits: it only reports a visit that carries an ad click identifier or a UTM tag.

When it does report a visit, it sends:

• the ad click identifier in the URL (Meta’s fbclid or TikTok’s ttclid) and any UTM tags,
• the landing page URL, the referring page, and a timestamp,
• a random identifier generated in that browser, so a later order can be matched to the click that preceded it.

It sends no name, no email, no phone number, no address, and no payment details. When an order comes in, we strip it down before it is stored anywhere: we keep the order id, subtotal, total, currency, and creation time, and we discard the customer record, email, name, phone, billing address, and shipping address. Any other note the merchant attached to the order is dropped too, because a merchant could have put personal information there.

If you connect Stripe, we record each payment the same way — the amount, currency, and timestamp, never the card number or other payment-method details, which stay with Stripe. We don’t yet run a click-collecting pixel on a Stripe-only storefront, so a payment we can’t tie to a stored click is recorded as an unattributed sale rather than credited to any ad — never guessed, never invented.

The practical result: we hold no individual customer identity data — not in our database and not in our raw-event storage. We want to be straight with you about the flip side, though. The random browser identifier and the ad click identifiers are pseudonymous, and they still count as personal data under the GDPR. We treat them that way: click and visit records are deleted automatically after 90 days, and raw events are stored under a per-workspace prefix specifically so they can be erased wholesale on request.

Functional storage.These are always on, because the site can’t work without them: your sign-in session, which workspace you’re looking at, your light or dark theme choice, whether you’ve dismissed a couple of onboarding prompts, and your answer to the analytics question below.

Analytics — only if you say yes. On our public home page we use Google Analytics to understand how people find us. It is off until you explicitly accept: if you decline, or haven’t answered yet, the Google script is never loaded at all and no analytics cookie is set. Accepting lets Google set its own _ga cookies to count returning visits. We ask everyone, not just visitors in regions that require it.

If you accept and later change your mind, we stop immediately — the script is never loaded again. Any _gacookie Google already set stays in your browser until it expires or you clear it, because it’s Google’s cookie and we can’t delete it for you.

We run no analytics and no advertising trackers inside the app itself— what you do in your dashboard is not measured by any analytics or advertising company. (We do use Sentry for error reports when something breaks; that’s listed below.) We run no advertising trackers anywhere.

Changing your mind is one click, and withdrawing is as easy as accepting — use the buttons below. Choosing “ask me again” clears your answer and stops analytics until you accept afresh.

On your storefront, the attribution pixel keeps one random identifier in the visitor’s browser storage, and only after your consent banner allows it.

We keep this list short on purpose. Each of these is a service we need to run Loopberry, not a data-sharing arrangement:

• Cloudflare — hosting, storage, queues, and outbound email.
• Neon — our Postgres database.
• Stripe — subscription billing and card processing.
• Sentry — error reports, so we find out when something breaks.
• Google Workspace — our own email.
• Google Analytics — measuring our own public marketing pages, and only for visitors who accept (see cookies, above).

Error reports pass through a filter before they leave our servers that removes tokens, sign-in links, database URLs, email addresses, and the attribution identifiers described above. That filter is covered by tests, because a scrubber nobody tests is a scrubber that quietly stops working.

If you use the Premium asset-generation features, the creative prompts you approve are sent to the generation vendor behind that feature. Your analytics, your orders, and your store visitors’ data are never part of that.

We do not sell your data, we do not rent it, and we do not share it with advertisers. We may disclose data if the law genuinely requires it.

Loopberry writes weekly narratives and suggested actions, but the running application makes no AI model calls at all. Every number you see is computed deterministically by our own code. Where wording is generated, it happens in a separate authoring step against figures our servers then re-derive and re-verify before storing.

Your data is not used to train any model, ours or anyone else’s, and it is never pooled with another customer’s to produce benchmarks or insights for someone else. That is what we mean when we say your data stays yours.

• Store visit and click records: 90 days, deleted automatically.
• Your analytics history, campaigns, and content: for as long as your workspace is open, so your year-over-year comparisons keep working.
• Connected-account tokens: until you disconnect that source, at which point they are deleted.
• Billing records: as long as tax and accounting rules require.

You have a few routes, depending on what you want gone.

• Disconnect one source.In the app, disconnecting Google, Meta, or TikTok immediately deletes that connection’s stored tokens and configuration, and asks the provider to revoke our access on their side too.
• Disconnect Stripe. Removes the connection right away. Unlike the sources above, we keep the payment records we already collected— that history is what makes your numbers meaningful if you reconnect — so disconnecting alone doesn’t erase them. Use the email route below if you want those erased too.
• Uninstall the Shopify app.When you uninstall, Shopify notifies us and we erase that shop completely and automatically: every visit record, every order record, the store itself, the encrypted connection, and the shop’s raw events in our storage.
• Ask us to delete everything. Email hello@loopberry.app from the address on your account and say you want your data deleted. We’ll confirm, then within 30 days erase your workspace and everything in it — including every visit and payment record, the connections themselves, and the raw events in our storage. Unlike a Shopify uninstall, this one is done by hand, so we’ll write back when it’s finished rather than leaving you to assume it.

If you shopped at a store that uses Loopberry: please contact that store directly. We hold no name, email, phone, or address for you — nothing that would let us find you in our systems even if we wanted to. When a store asks us to erase a customer, we honour it, and when a store leaves Loopberry we erase everything we hold for it.

Depending on where you live, you have the right to see what we hold about you, correct it, take it elsewhere, or have it deleted, and to object to how we use it. Email hello@loopberry.app and we’ll take care of it — no forms, no fee. We don’t sell personal information, so there is nothing for you to opt out of on that front.

Connected-account tokens are encrypted at rest with AES-256-GCM. Sign-in links are signed, single-use, and short-lived. Every page and endpoint that reads your data checks who you are first and refuses by default if it can’t tell. Every workspace’s data is scoped to that workspace at the query level. No system is perfect, and if something ever goes wrong that affects you, we’ll tell you promptly and plainly.

Questions, requests, or something here that doesn’t match what you’re seeing in the app? Email hello@loopberry.app. Our terms of service cover the rest of the relationship.