Privacy Policy

This Policy applies to Loocls accounts, applications, websites, support, and related services at loocls.com. Loocls is the controller of account, product usage, and support data described here.

When a business uses Loocls to collect information from its own customers through a published website, form, booking flow, or integration, that business normally determines why the information is used and acts as controller. We process that information on its instructions as a service provider or processor.

Paddle independently processes checkout and transaction data as Merchant of Record under its own privacy notice.

• Account data: email address, authentication records, profile details, preferences, roles, and account identifiers.
• Business and project data: business names, addresses, contact details, services, opening hours, websites, connected listings, and project settings.
• Content: prompts, text, images, files, reviews, knowledge sources, generated output, websites, and publishing instructions.
• Customer data you provide: information submitted through your sites, contact forms, bookings, imports, or integrations.
• Usage and technical data: IP address, browser and device information, timestamps, pages and features used, diagnostics, logs, cookie identifiers, and security events.
• Billing data: Paddle customer and subscription identifiers, plan, status, totals, currency, transaction references, and billing email. Paddle receives payment method and billing details directly; we do not store full card numbers.
• Communications: support requests, feedback, survey responses, and messages you send us.

We receive data directly from you, from people acting for your organization, automatically from your device and use of the Service, from Paddle and other providers supporting the Service, and from third-party services you choose to connect. We may also import public business information from directories or platforms at your request.

• provide accounts, subscriptions, credits, AI generation, hosting, publishing, support, and requested integrations;
• authenticate users, prevent abuse and fraud, investigate incidents, and protect the Service;
• monitor reliability, diagnose errors, measure product use, and improve features;
• send transactional messages about accounts, security, billing, and material Service changes;
• respond to support requests and enforce our Terms;
• comply with legal, accounting, tax, sanctions, and regulatory obligations;
• send marketing communications where permitted, with an unsubscribe option.

Where GDPR or similar law applies, our legal bases are performance of a contract, compliance with legal obligations, consent where requested, and legitimate interests in operating, securing, supporting, and improving the Service. We balance legitimate interests against your rights and expectations.

Prompts, files, business context, and other content needed for a generation request may be sent to AI infrastructure and model providers. Depending on the selected feature, these may include OpenRouter, the model provider routed through OpenRouter, and KIE.ai or its infrastructure partners for image and video processing.

Do not submit sensitive personal data, payment card details, government identifiers, health data, or confidential information unless the feature expressly requires it and you have a lawful basis. We do not use solely automated decisions that produce legal or similarly significant effects about you.

We disclose only the data reasonably needed for the following recipients and purposes:

• Supabase: database, authentication, and file storage.
• Paddle: checkout, Merchant of Record services, tax, invoicing, fraud prevention, subscription management, and refunds.
• AI and media providers: OpenRouter, routed model providers, and KIE.ai infrastructure used to fulfill generation requests.
• Infrastructure and communications providers: hosting, content delivery, security, monitoring, error reporting, and transactional email.
• Analytics providers: PostHog where enabled, subject to cookie and consent requirements.
• Professional advisers and authorities: where reasonably necessary to obtain advice, protect rights, investigate abuse, or comply with law.
• Corporate transactions: a buyer, investor, or successor under confidentiality protections during a merger, financing, reorganization, or sale.

We do not sell personal data for money. We do not use personal data for cross-context behavioral advertising. Providers may process data in multiple countries under their own legal obligations and our service arrangements.

The Service and its providers operate internationally. Data may be processed outside your country, including in countries with different privacy laws. Where required, transfers rely on recognized safeguards such as adequacy decisions, standard contractual clauses, or another lawful transfer mechanism.

We retain account and content data while your account is active and for a reasonable period afterward so we can provide exports, resolve disputes, enforce agreements, and meet legal duties. Security logs, backups, transaction references, and records required for tax, fraud prevention, or accounting may be kept longer.

Retention depends on the type, sensitivity, purpose, legal requirements, and risk of the data. When data is no longer needed, we delete or anonymize it. Deletion from encrypted backups may occur on the backup rotation schedule. Paddle retains transaction data under its own policy.

We use administrative, technical, and organizational safeguards designed to protect personal data, including access controls, encryption in transit, service-role separation, logging, and provider security controls. No online service can guarantee absolute security. You are responsible for protecting credentials and configuring your users and integrations appropriately.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal data, withdraw consent, and appeal or complain to a supervisory authority. You may also opt out of marketing emails using the link in the message.

Submit a request to [email protected]. We may verify your identity and authority before acting. Rights can be limited by law, including where records are needed for security, legal claims, accounting, or another person’s rights. Authorized agents may submit requests where local law allows.

We use essential cookies for authentication, security, preferences, and core operation. Optional analytics technologies are used only as permitted by applicable law and configuration. See our Cookie Policy for details and controls.

The Service is for adults and businesses and is not directed to children under 16. Account holders must be at least 18. If you believe a child provided personal data, contact us so we can investigate and take appropriate action.

We may update this Policy as the Service or law changes. We will post the new version and, where required, notify account holders of material changes before they take effect.

Privacy questions and requests: [email protected]. Website: loocls.com.