Privacy policy

Loops Tech Ltd is the controller for the personal data described in sections 2 to 4. You can contact us about anything in this policy at [email protected], or by post to 128 City Road, London, United Kingdom, EC1V 2NX.

We collect:

• Account details: your name, email address, mobile number, password (stored only in a scrambled, hashed form) and your role in the business.
• Business details: business name, country, time zone, sender name and settings.
• Login and security data: the IP address and browser of each login session, and codes we text you to confirm your mobile or log in on a new device.
• Billing data: top-ups, balance and what you've spent. Card payments are handled by Stripe; we never see or store your full card number.
• Support: what you tell us when you contact us.

We use it to:

• provide SendText, take payment and keep your account secure (to perform our contract with your business);
• send emails and texts about your account, such as login codes, team invitations, password resets, low balance and receipts (contract);
• prevent fraud and abuse, enforce our acceptable use policy and improve the service (our legitimate interests in running a safe, reliable service);
• keep financial records and meet other legal duties (legal obligation).

We don't send you marketing unless you've agreed to it, and you can stop it at any time.

• "Text me a demo": we use your mobile number once, to send the demo text. To stop the same number being sent repeat demos, we keep a one-way scrambled (hashed) version of it for a year, not the number itself.
• Spam protection: public forms use Cloudflare Turnstile to check you're a person. Cloudflare processes technical data about your browser and connection to do this.
• Fonts: some pages load fonts from Google Fonts, which means your browser connects to Google and shares your IP address with it.
• Server logs: like any website, our servers record requests (including IP address and browser) to keep the service secure and fix problems.

We do this on the basis of our legitimate interests in running a secure website and answering your request.

We only use cookies that are needed for SendText to work. We don't use advertising or analytics cookies.

• Login session: keeps you logged in.
• Trusted device: if you tick "Don't ask again on this device", remembers for 90 days that you've confirmed a login code here.
• Spam protection: Cloudflare Turnstile may set a cookie on pages with public forms.

When a business texts you through SendText, that business decides who to text and why, so it's the controller of your data and its own privacy policy applies. We process your data on its behalf, as its processor, under a contract that only lets us use it to provide our service to that business.

The business's contact list may hold your mobile number, name, birthday, tags, how and when you agreed to get texts, the messages sent to you and your replies, and when you tapped a link (with your browser type).If the business uses our AI features, the text of your replies may be processed by our AI provider to suggest a response.

• To stop texts, reply STOP to any text, or tap the opt-out link at the end of it if the text came from a name rather than a number. You're removed straight away and that business can't text you marketing again through SendText.
• To see, correct or delete your data, ask the business that texted you. If you can't reach them, email us at [email protected] with the sender name and we'll pass your request on and help them deal with it.
• If you signed up on a business's SendText sign-up page, we text you once to confirm. You're only added to their list once you confirm.

We keep a record of opt-outs even if the business deletes you as a contact, so you can never be texted again by mistake.

We don't sell personal data. We share it only with the service providers we need to run SendText, under contracts that protect it:

• Hosting and database: runs our servers and stores our data.
• Twilio: delivers texts to and from mobile networks.
• Stripe: takes card payments and handles VAT.
• Anthropic: powers the optional AI writing and reply suggestions.
• Resend: sends account emails.
• Cloudflare: spam protection on public forms.
• Sentry: reports errors in our software so we can fix them.
• Google Fonts: serves fonts used on our website.

We may also share data if the law requires it, to protect people from fraud or harm, or with a buyer if SendText is ever sold (who would have to respect this policy).

Some of the providers above are based in, or process data in, the United States or the EU. Where data leaves the UK, we rely on UK adequacy regulations (including the UK–US data bridge for certified companies) or the ICO's International Data Transfer Agreement or Addendum, so it stays protected to UK standards.

• Account and business data: while the account is open, then deleted 30 days after it closes (it can be reopened until then).
• Contacts and messages: until the business deletes them, or 30 days after it closes its account.
• Billing and tax records: 6 years, as UK tax law requires.
• Opt-out records: for as long as we provide the service, so opt-outs are always honoured.
• Demo text records (hashed numbers): 1 year.
• Server and error logs: up to 90 days.
• Login and confirmation codes: minutes; unconfirmed sign-up links: 7 days.

Data is encrypted in transit, passwords are hashed, access is limited to the people who need it, and new-device logins can require a texted code. No system is perfectly secure, but if a breach puts your data at risk we'll tell you and the ICO as the law requires.

Under UK data protection law you have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted, or its use restricted, in some circumstances;
• object to us using it on the basis of legitimate interests, and to any direct marketing;
• get data you gave us in a portable format;
• withdraw consent, where we rely on it.

Email [email protected] to use them. We'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to put it right first.

We'll update this policy when what we do with data changes, and change the date at the top. If a change is significant, we'll tell account owners by email. See also our terms of service.