Privacy policy

Effective 5 September 2026. Draft for review.

This is a working draft written to match what the software actually stores. It has not yet been reviewed by a lawyer.

What we collect

• If you write to us through the form on this site: your name, email, company, website, the platforms you use, your budget band and your message. We keep it to reply to you.
• If you become a client: your email for sign-in (there are no passwords), the devices you sign in from, your brand profile, the content we draft and publish for you, files you upload, the messages you exchange with us, and the tracked-link clicks and platform metrics attached to your posts.
• Connected accounts: the access tokens each platform issues when you authorise us, and the account handle. Never your password.
• Billing: your plan, its status and invoice dates. Card details are held by Stripe, our payment processor; we never see them.
• Readers of published posts: when someone clicks a tracked link we record the time, the referring page and the browser type, so your report can show which post earned the click. No cookies are set on readers, and known bots are excluded from the count.

How we use it

To do the work described in the terms: draft in your voice, publish what you approved, measure what happened, and report it to you. We do not sell personal data, we do not use your content to train models, and we do not use your data for anything unrelated to your account.

Who else sees it

Subprocessors we rely on, each under its own agreement: Railway (hosting), Infisical (secret storage for connection tokens), Stripe (payments), Resend (transactional email), Anthropic (the model that drafts text from your brief; it receives your brief, voice and articles, never your connection tokens or your card), and the platforms you connect, which receive only what you approved for publication.

Security

Sign-in is by single-use email link, bound to the browser that asked for it, with passkeys or an authenticator app as a second factor. Connection tokens live in an encrypted secrets vault. Every action that changes anything is written to an audit log with who did it.

How long we keep it

For as long as you are a client, and for the audit and invoice record afterwards. On request when the service ends we delete your content, files, messages and connection tokens; the audit lines that say what was done, and the invoices, are kept.

Your rights

You can see, correct, export or delete your data by asking us at hello@loudloom.dev. If you are in the EU or UK you have the rights the GDPR gives you, including to complain to your supervisory authority.

Contact

Loudloom · hello@loudloom.dev