Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including:

• Name and email address when you create an account
• Payment information when you subscribe to a paid plan (processed securely by Creem, our payment provider)
• Business information you provide during onboarding (product details, website URLs, business descriptions)
• Data from the accounts you connect: ad account data (campaign performance, creative assets, audience data) and, if you connect Google Analytics, the Google Analytics 4 properties and reports you ask about
• Communications you send to us (support requests, feedback)
• Answers you give in our onboarding quiz before you create an account (for example how you run ads today and which AI assistant you want to use), which we link to your account if you go on to sign up

2. Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

• IP address and approximate geographic location
• Browser type, version, and language preferences
• Device type, operating system, and screen resolution
• Pages visited, features used, and time spent on the Service
• Referring URL and how you arrived at our website
• Interaction data such as clicks, scrolls, and navigation patterns

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our AI advertising services
• Generate AI-powered ad creatives, images, and campaign recommendations
• Optimize your ad campaigns and generate performance insights
• Process payments and manage your subscription
• Send you updates, marketing communications, and product announcements
• Respond to your comments, questions, and support requests
• Monitor and analyze trends, usage, and activities in connection with our services
• Detect, investigate, and prevent fraudulent transactions and other illegal activities

4. AI Processing

LoomaScale uses artificial intelligence to generate ad creatives, analyze products, and optimize campaigns. When you use our AI features:

• Your product information, business descriptions, and website data may be processed by AI models to generate relevant content
• AI-generated outputs are created specifically for your campaigns and are not shared with other users
• We may use anonymized and aggregated data from AI interactions to improve our models and services; this never includes data received from Google APIs (see section 6.2)
• We do not use your personal information or identifiable business data to train third-party AI models

5. Data Sharing

We do not sell your personal information. We may share your information with:

• Payment processors — Creem processes your payment information securely. We do not store your credit card details.
• Service providers — third-party providers who perform services on our behalf, such as hosting, analytics, and email delivery. Our application server and database are hosted on Amazon Web Services (Amazon EC2, eu-west-1 region, Ireland). These providers are contractually obligated to use your data only as necessary to provide services to us.
• Advertising and analytics platforms — when you connect your ad accounts or Google Analytics, data flows between LoomaScale and the connected platforms (Meta and Google) as necessary to manage your campaigns and answer your questions.
• Assistant platforms — if you connect LoomaScale to an AI assistant (ChatGPT, through OpenAI, or Claude, through Anthropic), the answers we return to your questions (ad account, Facebook Page, campaign, ad set and ad names and ids, Google Analytics property names, and the performance and analytics figures you asked for) are delivered into that conversation and processed by the assistant's provider to render the reply.
• Advertising measurement — we send conversion events about our own marketing (such as a signup or a purchase) to Meta's Conversions API and to Google Ads, including a hashed form of your email address, so that the ads that brought you here can be measured.
• Operational alerts — our team receives internal notifications about account activity (for example a new signup or a failed connection) through Telegram, and those messages may contain your email address.
• Legal requirements — we may disclose your information if required by law, regulation, or legal process.

6. Ad Account and Analytics Data

When you connect your ad accounts (Google Ads, Meta Ads) or Google Analytics, we access your data through official platform APIs. This data is used exclusively to manage your campaigns, answer your questions and provide performance insights. It is never shared with other users or sold to third parties. You can disconnect your accounts and request data deletion at any time.

6.1 Google Permissions We Request

When you connect Google, LoomaScale asks only for the permissions the feature you are connecting needs, each on Google's own consent screen:

• Sign-in (openid, email, profile) — your name, email address and Google account identifier, used to create your LoomaScale account and sign you in.
• Google Ads (https://www.googleapis.com/auth/adwords) — read and manage the Google Ads accounts you allow: campaigns, ad groups, ads, keywords, budgets, assets, conversion actions and performance reports. Changes are made only when you ask for them, within the limits described in our Terms of Service.
• Google Analytics (https://www.googleapis.com/auth/analytics.readonly) — read-only access to the Google Analytics 4 accounts and properties your Google login can view: property settings and reports such as sessions, users, conversions and traffic sources. LoomaScale cannot change your Analytics configuration or data.

We store the access and refresh tokens Google issues (encrypted at rest), the names and identifiers of the Google Ads accounts and Google Analytics properties available to your login, and, for Google Ads, account-level spend and budget totals used to apply your daily spend cap. Google Analytics reports are fetched live when you ask for them and are not stored in our database.

6.2 Google API Services User Data Policy

LoomaScale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features you use it for: answering your questions about your Google Ads and Google Analytics accounts and making the Google Ads changes you request.
• We transfer it only to provide those features — to the AI assistant you connected (ChatGPT or Claude), in reply to your own requests — or to comply with applicable law, or as part of a merger, acquisition or sale of assets after notice to you.
• We do not use or transfer it to serve advertising, including retargeting, personalized or interest-based ads, and we do not sell it.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
• No one at LoomaScale reads it unless you give us permission for a specific request (for example a support request), it is needed for security purposes such as investigating abuse, it is required by law, or it has been aggregated and anonymized for internal operations.

7. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest (AES-256), regular security audits, and strict access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. We encourage you to use strong, unique passwords for your account.

8. Cookies and Tracking

We use cookies and similar tracking technologies to collect and track information about your use of our website. This includes analytics cookies to understand how visitors interact with our site and functional cookies to remember your preferences. See our Cookie Policy for more details.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy, including the use of standard contractual clauses where required.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you request deletion, we will remove your data within 30 days, except where we are required by law to retain it. Anonymized and aggregated data may be retained indefinitely for analytics and service improvement purposes.

11. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Object to or restrict certain processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at team@loomascale.com.

12. GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), we process your personal data on the following lawful bases:

• Contract performance — processing necessary to provide the Service you subscribed to
• Legitimate interests — improving our services, preventing fraud, and ensuring security
• Consent — where you have given explicit consent, such as for marketing communications
• Legal obligation — where processing is required by applicable law

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated. For data protection inquiries, contact us at team@loomascale.com.

13. CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know — you can request details about the personal information we collect, use, and share
• Right to delete — you can request deletion of your personal information, subject to certain exceptions
• Right to opt-out — we do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" option.
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at team@loomascale.com.

14. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at team@loomascale.com.

15. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For material changes, we will provide additional notice via email or through the Service. Your continued use of our services after any changes constitutes acceptance of the updated policy.

16. Third-Party AI Services

LoomaScale uses third-party artificial intelligence services to power its features. By using our Service, your data may be processed by the following providers:

• Google Gemini — used for AI image generation and text content creation. Product descriptions, prompts, and uploaded images may be sent to Google's API for processing.
• Creem — used for content moderation. Text prompts submitted for image generation are reviewed by Creem's moderation API to ensure compliance with content policies.
• OpenAI — LoomaScale is available as a connector inside ChatGPT. When you manage advertising through that connector, the data we return in answer to your requests — including connected ad account, Facebook Page, campaign, ad set and ad names and identifiers, Google Analytics property names, and the performance and analytics figures you asked for — is delivered into your ChatGPT conversation and processed by OpenAI in order to produce the assistant's reply to you.
• Anthropic — LoomaScale is available as a connector inside Claude, listed in Claude's connector directory. When you manage advertising through that connector, the same data described above is delivered into your Claude conversation and processed by Anthropic in order to produce the assistant's reply to you.

We only share the minimum data necessary for each service to function. These providers process data in accordance with their own privacy policies and data processing agreements. We do not share your payment details with these AI service providers. Advertising account and Google Analytics data is shared only with the assistant provider you connected (OpenAI or Anthropic), and only for the connector described above, in response to your own requests; it is never shared with Google Gemini or Creem.

17. Contact Us

If you have any questions about this Privacy Policy, please contact us at team@loomascale.com.