Privacy policy

1. Who is responsible

Loomduct is run by Evangelos Yfantis, a sole trader based in Greece. For the data in sections 2 to 4, we are the controller under the GDPR. You can reach us at legal@loomduct.com.

2. Visiting our website

• Our website sets no cookies and shows no ads.
• Like every website, our servers receive your IP address and browser details to send you the page. We keep them in server logs for up to 30 days to keep the website running and secure, and we don’t use them to identify you.
• The status badge in the footer gets its status from our status page provider, incident.io, through our servers. Your browser connects to them only if you open the status page.
• We may measure our own website with Loomduct, in its cookieless mode, described in section 5.

We do this based on our legitimate interest in running a secure website and understanding how it is used.

3. Your Loomduct account

When you create an account and use the dashboard, we process:

• Account details: your name, email address, password (stored only as a secure hash), profile photo if you add one, and the organizations, projects, team members and API keys you set up. We need these to give you the service (contract).
• Sign-in with Google or GitHub: if you choose it, we receive your name, email address and profile photo from them. Their own privacy policies apply to your account with them.
• Billing details: your billing name, address and VAT number, and your payment history, held by our payment provider, which also processes your payment card. We need these for the contract and to keep the records Greek tax law requires.
• Sign-in and security data: your IP address, browser and sign-in times, to keep your account secure and stop abuse (our legitimate interest).
• Emails with us: support requests and messages you send us, and the emails we send you about your account, such as sign-in codes, password resets, invitations and important changes. We need these to give you the service and to help you (contract and legitimate interest). Payment receipts and invoices are sent by our payment provider.

You need to give us your name and email address to create an account. Without them, we can’t give you the service.

The dashboard only uses cookies it needs to work: to keep you signed in, to keep sign-in with Google or GitHub secure, and to remember whether you closed the sidebar. They don’t need your consent. We don’t use advertising or tracking cookies.

We never sell your data, and we don’t use it for advertising.

4. How long we keep your data

• Account data: while your account is open. When you delete it, we delete your data within 30 days, and from backups within 30 more days.
• Billing records: for as long as Greek tax and accounting law requires.
• Sign-in and security data: up to 30 days after your sign-in session ends.
• Website server logs: up to 30 days.
• Emails with us: as long as needed to help you, then deleted.

5. Data we process for our customers

When a website or app uses Loomduct, we process data about its visitors on behalf of that customer. The customer is the controller and decides why the data is collected. We are their processor, under our Data processing agreement. If you visited a site that uses Loomduct, please read that site’s privacy policy, and send privacy requests to them.

What Loomduct collects about visitors

• The page address, page title and the site that sent them.
• Campaign tags, such as UTM parameters, in the page address.
• Browser, operating system and device type, read from the user agent.
• Screen size and browser language.
• Country, region and city, worked out from the IP address.
• How long the page was open and how far the visitor scrolled, and a session id that groups the pages of one visit.
• Events and properties the customer chooses to send, such as sign-ups and purchases.
• Page speed measurements.

How we protect visitors

• No cookies by default. Loomduct sets no cookies and, in its default mode, stores nothing on the visitor’s device.
• IP addresses are never stored. We use the IP address only for a moment, to find the location and to create an anonymous visitor id, and then we throw it away. It is never saved in our database or logs.
• Anonymous ids reset every day. The visitor id is made with a new random secret for each website every day. We delete each secret a few hours after its day ends, so the same person can’t be followed from one day to the next or across different websites.
• Bots are detected and marked, and customers can choose to drop them completely.
• Data stays in the EU. Analytics data is stored on servers in the EU.

Customers can turn on two optional features, and are responsible for asking their visitors for consent where the law requires it: persistent visitor ids, which store an id in the browser’s local storage, and identifying logged-in users, which links visits to the user id the customer sends.

We keep analytics data for as long as the customer keeps their account, unless they delete it sooner. When an account is closed, we delete its data within 30 days, and from backups within 30 more days.

6. Who we share data with

We use a small number of companies to run Loomduct, such as our cloud provider, email provider, payment provider and support tool. They only process data on our instructions, under data processing agreements. Only our infrastructure providers handle the analytics data of our customers’ visitors. The others only handle data about our own account holders.

The full and latest list, with what each company does and where, is on our Subprocessors page.

We look up locations with a database from MaxMind that runs on our own servers, so no IP address is sent to MaxMind. To show the icons of websites that send visitors to our customers, we fetch them from Google’s icon service using only the website’s domain name, such as news.ycombinator.com, never data about a visitor. We may also share data if the law requires it.

7. Data outside the EU

We store analytics and account data in the EU, and our customers’ visitor data never leaves the EU for storage. Our CDN delivers our tracking script from servers close to each visitor, which can be outside the EU, without storing the requests. Some companies that only handle data about our account holders, such as our payment provider and support tool, may process it outside the EU, as shown on our Subprocessors page. These transfers are covered by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. How we keep data safe

We use encrypted connections (HTTPS), store passwords only as secure hashes, limit who can access production systems, keep servers updated, and take regular backups. No system is perfect, but if a data breach affects you, we will tell you and the authorities as the law requires.

9. Your rights

Under the GDPR you have the right to:

• get a copy of your data;
• correct data that is wrong;
• have your data deleted;
• limit or object to how we use it;
• get your data in a portable format;
• withdraw consent, where we rely on it.

Where we rely on our legitimate interest, you can object at any time. We don’t make decisions about you based only on automated processing.

Email us at legal@loomduct.com and we will answer within one month. You can also complain to the Hellenic Data Protection Authority (dpa.gr), or to the authority in your own EU country.

10. Children

Loomduct is for businesses and is not meant for anyone under 18. We don’t knowingly collect data from children.

11. Changes to this policy

If we change this policy in an important way, we will email account holders before the change applies. The date at the top always shows the latest version.