Loopsee

Privacy Policy

This Privacy Policy (the “Policy”) explains how Loopsee s. r. o. processes personal data of users of the Loopsee mobile application and visitors to the Loopsee website. Cookies and similar technologies used on the website are addressed in a separate Cookie Policy.

We process personal data primarily in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”).

1.Who We Are

The controller of personal data is:

Loopsee s. r. o.

Dunajská 3, 811 08 Bratislava – Staré Mesto, Slovak Republic

Identification No.: 57 771 464

registered in the Commercial Register of the City Court Bratislava III, Section: Sro, File No. 201937/B

Email for data protection matters: gdpr@getloopsee.com

2.Who and What This Policy Covers

This Policy applies primarily to registration and use of the Application, creation of a user profile, creation of Loops, interpretation of requests through artificial intelligence (AI), matching and connecting users, making information available to the extent enabled by the Application’s features, chat and other communications, use of location features, voice, image and video inputs, security and moderation, service notifications, user support and management of Loopsee Premium subscriptions.

3.What Personal Data We Process

Depending on which Loopsee features you use, we may process the following categories of data in particular:

  • •
    account and registration data – email address, authentication data or tokens, nickname, date of birth, interface language, confirmation that you are at least 18, records of acceptance of terms and verified telephone number;
  • •
    data from sign-in with Apple or Google – in particular an identification token and data made available by the relevant provider as part of the sign-in method selected; the name provided by the provider may be used as a suggested nickname;
  • •
    voluntary profile data – in particular profile photograph, gender, languages, nationality, location, occupation, hometown, education, height, weight, interests, skills, and a self-introduction in text, voice or video;
  • •
    service usage data – Loop content, requests and intentions, availability, preferences, responses to Match proposals, rejections, blocks, interactions, feedback, Match data and structured AI outputs;
  • •
    location data – a place entered by the user and, if the user permits access to the device location, the approximate location of the device; Loopsee does not track location in the background or create a movement history;
  • •
    communication data – the content of messages between matched users, conversation identifiers and related technical data;
  • •
    photographs, voice and video – content that the user chooses to upload or create, including materials needed for transcription, safety assessment or profile processing;
  • •
    reporting, blocking and moderation data – user identifiers, the category and text of a report, status, timestamps, diagnostic context and data needed to prevent repeated abuse;
  • •
    technical and security data – IP address, user or device identifier, platform, application version, server requests, error and diagnostic data, security logs and cryptographic hashes of selected identifiers;
  • •
    notification data – Expo push token, user and device identifier, platform, enabled status and timestamps;
  • •
    subscription data – subscription status and Premium entitlements, purchase identifiers, purchase receipts or tokens and other data needed to verify a purchase and restore a subscription. Loopsee does not directly process payment card data; payments are handled by the Apple App Store or Google Play.
  • •
    consent grant and withdrawal data – scope and version of the consent stattement, user identifier, method, time and status of consent, and the time of any withdrawal;
  • •
    special categories of personal data – only if voluntarily provided by the user and where an applicable legal basis exists; sensitive matching may also involve derived information that can be linked to the user;

4.Purposes, Legal Bases and Retention Periods

We process personal data only for specific purposes and on an applicable legal basis. The table below sets out our main processing activities. For optional processing of a user’s own special categories of data for the purposes of Loops and matching, we rely on consent under Article 6(1)(a) in conjunction with explicit consent under Article 9(2)(a) GDPR. The periods stated are retention periods or criteria for determining them. Longer retention is considered only to the extent permitted by law and necessary, for example to comply with a legal obligation or to establish, exercise or defend legal claims.

Purpose

Data

Legal basis

Retention / criterion

Registration, account and provision of the service

Account data, nickname, date of birth, language, age confirmation, telephone number, authentication data

Art. 6(1)(b) GDPR – performance of a contract; for security checks also Art. 6(1)(f)

For the duration of the account; after deletion only to the extent necessary to comply with legal obligations or to establish, exercise or defend legal claims

Telephone number verification and prevention of misuse

Telephone number, verification status and time, country, cryptographic hash of the number

Art. 6(1)(b) and (f) GDPR

Telephone number for the duration of the account; a security hash relating to a ban only for a period proportionate to preventing repeated misuse

Profile and social connections

Voluntary profile data, photograph, interests, skills, text/voice/video introduction

Art. 6(1)(b) GDPR; optional sensitive processing under Art. 9(2)(a) GDPR

Until the user removes the data or deletes the account, unless there is a reason for longer retention

Location features

Place entered by the user, approximate device location, search area, Loop location

Art. 6(1)(b) GDPR; access to device location is also subject to the device permission settings

Data linked to a particular Loop is retained according to that Loop’s lifecycle; Loopsee does not retain movement history

AI processing and matching

Loops, availability, location, selected profile data, interactions, feedback

Art. 6(1)(b) GDPR; for security also Art. 6(1)(f); sensitive matching under Art. 9(2)(a) GDPR

For as long as necessary for the Loop, matching and account to function; auxiliary records only for a proportionate period

Optional sensitive data in the user’s own Loops and AI matching

Data under Art. 9 GDPR voluntarily provided by the user; related transcripts, structured and derived data, matching outputs and disclosure to relevant users

Art. 6(1)(a) and Art. 9(2)(a) GDPR – explicit consent

For the duration of the relevant consent and the need for the specific Loops; after withdrawal, deletion or restriction of further use unless another legal basis exists

Records of consent granted and withdrawn

User identifier, purpose, wording and version of consent and information, date, time, method, status and withdrawal

Art. 6(1)(c) GDPR in conjunction with Art. 7(1); where applicable, Art. 6(1)(f) for protection of legal claims

For as long as necessary to demonstrate the lawfulness of processing and, where applicable, for the establishment, exercise or defence of legal claims

Chat and communications

Messages, conversation identifiers and technical data

Art. 6(1)(b) GDPR; for handling incidents Art. 6(1)(f) or (c)

For as long as necessary to provide the conversation and thereafter under retention rules; upon account deletion, data is deleted or anonymised to the extent technically and legally possible

Photographs and media

Profile photographs, photo gallery, video introduction and derived materials

Art. 6(1)(b) GDPR; safety assessment under Art. 6(1)(f)

Until removed by the user or account deletion; temporary processing materials are deleted after the operation is complete

Service push notifications

Push token, user, device, platform, enabled status and, where applicable, nickname or short message preview

Art. 6(1)(b) GDPR

While the token is active and needed to provide notifications; at the latest upon logout/account deletion or invalidation of the token

Reporting, blocking and moderation

Report data, blocks, assessment status and outcome, security identifiers

Art. 6(1)(f) GDPR – security, user protection and prevention of misuse; Art. 6(1)(c) where processing is required by law

For as long as necessary to handle the report and for a proportionate period to prevent repeated misuse or to establish, exercise or defend legal claims

Security and technical operation

IP address, identifiers, server requests, errors, diagnostics, security logs

Art. 6(1)(f) GDPR – security and stability of the service

Only for a period proportionate to diagnostics, security and incident handling; longer only in connection with a specific incident or legal claim

Loopsee Premium subscription

Subscription status, purchase identifiers or tokens, product, period and technical purchase data

Art. 6(1)(b) GDPR; Art. 6(1)(c) for legal obligations

For the duration of the subscription and thereafter only to the extent necessary for accounting, tax, consumer-law and legal obligations

Support and exercise of rights

Contact details, request content and related communications

Art. 6(1)(b), (c) or (f) GDPR, depending on the nature of the request

For the period needed to handle the request and thereafter for as long as needed to evidence its handling or to establish, exercise or defend legal claims

5.Special Categories of Personal Data

In ordinary use, Loopsee does not require data falling within the special categories of personal data under Article 9(1) GDPR. However, a user may voluntarily include in their own Loop information that contains or reveals such data. This may include, in particular, information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, sex life or sexual orientation.

For the optional use of a user’s own special categories of data when creating and interpreting Loops, using AI to process related text or voice inputs, creating structured and derived data, searching for compatible users and connecting them, we obtain separate, freely given and explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. Consent may also cover data directly apparent from the content of a Loop if necessary for that purpose; it does not cover the creation of unrelated sensitive inferences about the user.

The user may give consent by a separate affirmative action during registration or later in the Application settings. Consent is not given by default, is not part of acceptance of the terms and conditions, and is not a condition for using Loopsee’s basic features. Once given, consent also covers the user’s subsequent Loops processed for the same purpose; we therefore do not request new consent for each such Loop.

If the user has not given explicit consent under this Article, we do not use their special categories of personal data for AI interpretation of Loops, creation of related derived representations, matching or making such data available to other users as part of matching.

If, when using the Application, an input is identified as containing content that requires explicit consent for further processing for the purposes described above, we will stop that further processing and notify the user. The user may edit the input so that it no longer contains the relevant special categories of data, or may give explicit consent later in the Application settings.

We carry out preliminary assessment of inputs and security checks only to the extent that the applicable conditions for lawful processing of personal data are met. If such assessment involves processing special categories of personal data, a legal basis under Article 6 GDPR and an applicable condition under Article 9(2) GDPR must be met. Merely entering or submitting sensitive data in the Application does not constitute explicit consent. Consent given later does not retroactively make earlier processing lawful.

To the extent necessary for the relevant feature to function, we may make the content of a Loop, including any sensitive information, available to other users for whom the Loop is intended or to whom it is shown as part of matching. By default, a user appears in the Application under a nickname; however, this does not guarantee anonymity. In some circumstances, the user’s identity may be inferred from the content of a Loop, a photograph, location, subsequent communications or other circumstances. Visibility depends on the feature and settings of the particular Loop.

Explicit consent may be withdrawn at any time in the Application settings or by emailing gdpr@getloopsee.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, we will stop further use of the relevant special categories of data for the purpose based on consent and will also delete related derived data unless another permissible legal basis exists for further processing. Withdrawal cannot retrospectively undo information that another user has already lawfully seen.

A user account belongs to one natural person, who may use the Application to organise activities for a couple or group. Their consent relates exclusively to their own data. It does not authorise them to provide or use a partner’s, group members’ or other third parties’ special categories of personal data for matching. Loops may therefore contain ordinary organisational information about a group, but not special categories of data relating to other identifiable persons without a separate applicable legal basis. Unauthorised content may be rejected or removed.

We keep an appropriate record of the grant and withdrawal of consent, including the user identifier, the wording and version of the consent and information notice, the purpose, method and time of consent, its current status and any time of withdrawal. These records serve to demonstrate the lawfulness of processing; we do not retain the actual content of sensitive Loops solely for this record-keeping purpose.

6.AI, Profiling and Matching

Loopsee uses automated and AI systems primarily for voice transcription, understanding requests, generating a draft structured Loop, safety assessment, profile processing, assessment of selected images, match scoring and explanation, and translations. Depending on the operation, the data processed may include Loop text, requests, availability, location, selected profile data, feedback, nicknames, internal identifiers and relevant media.

Matching takes into account, in particular, the activity, time, place, level, number of people, requests, preferences and profile context, and may also take account of previous rejections, blocks, interactions and feedback. Such processing may constitute profiling within the meaning of the GDPR. If a user’s own data falling within the special categories under Article 9 GDPR is to be used in AI interpretation or matching, the rules in Article 5 of this Policy apply.

However, Loopsee does not use matching to make decisions based solely on automated processing which produce legal effects concerning a user or similarly significantly affect them. The user always decides whether they are interested in a Match proposal and whether to contact a particular person.

Ordinary chat between matched persons is not sent to an AI system for AI matching purposes unless the user expressly uses a feature for which such processing is necessary and is informed about it.

7.Location

Loopsee may use a place entered by the user and, if the user grants the device permission, the approximate location of the device. The Application does not implement background location tracking or a movement history. Coordinates used for the context of a Loop are rounded before being sent to the server. If the user refuses location access, Loopsee may use the profile location or a place entered by the user.

We use Mapbox for geocoding, reverse geocoding and searching for places or businesses. Requests are routed through our server, and the information sent to Mapbox consists primarily of the place text and, where relevant, approximate coordinates and country code, not a direct user identifier.

8.Voice, Video and Photographs

If a user uses voice input, the recording is sent to the Loopsee server for the relevant feature and then to an AI provider to generate a transcript. Raw recordings are not intended to be stored permanently on the Loopsee server, and temporary server files are deleted after processing. The text transcript may remain part of a Loop or profile depending on the feature used by the user. Voice input or its transcript may also contain special categories of data; Article 5 governs any further use of such data for AI matching.

For a voluntary video introduction, Loopsee may separate the audio for transcription and select certain video frames for automated assessment. Profile photographs may be sent to an AI provider for safety assessment. A rejected upload is deleted.

9.Chat and Private Communications

Messages between matched users are stored in a database used by Loopsee. Communications are not protected by end-to-end encryption; authorised Loopsee personnel may therefore have the technical ability to access their content. We access message content only to the extent necessary, in particular for justified support, reports, a security incident, prevention of misuse or compliance with a legal obligation. Access is restricted according to work-related need and is subject to internal security rules.

If a user voluntarily shares data in chat that may be sensitive, they make it available to the recipients of that conversation. Consent to sensitive AI matching under Article 5 does not automatically apply to other, unrelated processing purposes involving private messages.

A preview of a new message may be included in a push notification and may be transmitted through Expo and Apple or Google infrastructure. If the operating system allows, the user may restrict previews through the device settings.

10.Reporting, Blocking and Security

To protect users and the service, we process data about reports, blocks, security incidents and breaches of the rules. A report may store a link to the identifier of a specific message or other content. In the case of a security ban, we may retain a cryptographic hash of an email address or telephone number after account deletion if reasonably necessary to prevent circumvention of the ban and repeated registration.

11.Push Notifications

We use service push notifications, for example, to notify users of a new Match, message or change in the status of a Loop. We use Expo, Apple Push Notification service or Firebase Cloud Messaging/Google to deliver them. A notification may contain a nickname or a short message preview. We do not currently send marketing push notifications.

12.Loopsee Premium Subscription

Payments for Loopsee Premium are processed by the Apple App Store or Google Play. Loopsee does not directly process payment card data. We use RevenueCat to verify purchases, record subscription status, restore purchases and enable Premium benefits. RevenueCat may process Apple purchase receipts, Google purchase tokens, subscription status, technical device data and, depending on the configuration, an internal user identifier.

13.Recipients and External Providers

We use external technology providers to provide Loopsee. Depending on the service concerned, they may act as our processors, sub-processors or independent controllers. They currently include, in particular:

Provider

Purpose

Supabase

Authentication, database, media storage and real-time communication

Render

Application server and backend hosting

OpenAI

Transcription, AI processing, safety assessment and matching

Mapbox

Geocoding, reverse geocoding and place search

Expo

Application technical services and push notifications

Apple and Google

Application distribution, sign-in, push notifications and payments; for some activities they act as independent controllers under their own terms

RevenueCat

Purchase verification and Premium subscription status management

Twilio

Telephone number verification by SMS and, where applicable, checking telephone line type

Resend

System and internal emails, reports and contact form

Vercel

Website and legal pages hosting

We disclose data to public authorities, courts or other authorised entities only if required by law or necessary to protect our rights or the rights of others.

14.Transfers of Personal Data Outside the European Economic Area

Some of our providers or their subcontractors may process personal data in the United States or other countries outside the European Economic Area. This may concern, in particular, certain services provided by OpenAI, Render, RevenueCat, Twilio, Supabase, Expo, Vercel and other technology subcontractors, depending on their specific configuration and processing region.

If personal data is transferred to a third country, we use mechanisms permitted by the GDPR, in particular a European Commission adequacy decision where it applies to the relevant recipient, or the European Commission’s standard contractual clauses together with appropriate supplementary measures. Information about the specific mechanism or a copy of the appropriate safeguards may be requested at gdpr@getloopsee.com.

15.Sources of Data

We obtain most data directly from the user. We obtain some data from the user’s device when the Application is used, from sign-in through Apple or Google, from the technical systems of our providers, or from the App Store/Google Play and RevenueCat when managing a subscription. Security and moderation data may also originate from a report by another user. Information about other persons may also appear in user-generated content; such information is subject to the restrictions in Article 5.

16.Required and Voluntary Data

Without the data needed to create and secure an account, in particular a nickname, date of birth, supported login credential, confirmation of age and verified telephone number, we may be unable to make the Application available to the user. Other profile information is generally voluntary. Explicit consent to process the user’s own special categories of data for the purposes in Article 5 is optional, and refusing consent does not prevent use of the Application’s basic features that do not require such processing. For selected profile data, the user may choose whether to make it available to their Matches. The date of birth is not shown to other users; if the user enables age sharing, the derived age, not the date of birth, is displayed.

17.How We Protect Personal Data

We use appropriate technical and organisational measures commensurate with the nature of the data and the risks of processing, in particular access-rights management, authentication, encrypted data transmission, separation of public and non-public data, security logging, restricted administrator access and procedures for handling security incidents. We regularly review and appropriately update these measures.

18.Account Deletion and Retention After Deletion

A user may request account deletion directly in the Application or by contacting gdpr@getloopsee.com. When an account is deleted, we terminate active Loops and Matches and delete or anonymise account and profile data, the user’s own messages, notification tokens and the authentication account to the extent that further retention is not necessary for legal or security reasons.

Some data may remain for a limited time in backups or security records until the backups are routinely overwritten. Apple, Google or RevenueCat may continue to retain purchase data in accordance with their own legal obligations and retention rules. Deleting an account in Loopsee does not automatically cancel an active App Store or Google Play subscription; the subscription must be managed in the relevant store.

Withdrawal of explicit consent stops further processing of special categories of personal data for purposes based on the withdrawn consent. Personal data processed exclusively for those purposes, including related derived data, will be deleted unless another legal basis permits further retention. Withdrawal of consent does not, by itself, cancel the basic user account.

19.Your Rights

As a data subject, you have, to the extent provided by the GDPR, in particular the right:

  • •
    to access your personal data and information about its processing;
  • •
    to have inaccurate personal data rectified and incomplete personal data completed;
  • •
    to have personal data erased where the statutory conditions are met;
  • •
    to restrict processing;
  • •
    to data portability where processing is carried out by automated means and is based on consent or a contract;
  • •
    to object to processing based on legitimate interests;
  • •
    to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
  • •
    to lodge a complaint or a petition to initiate proceedings with a supervisory authority.

You may exercise your rights by contacting gdpr@getloopsee.com. You may also withdraw consent to optional sensitive AI matching directly in the Application settings. We will respond without undue delay, usually within one month. If a request is complex or there are multiple requests, the statutory period may be extended by a further two months; we will inform you of any extension and its reasons.

Loopsee does not currently provide a self-service data export, but this does not restrict your right of access or data portability. You may request an export at gdpr@getloopsee.com.

20.Supervisory Authority

If you believe that the processing of your personal data breaches the law, you may contact the Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, 821 04 Bratislava, email: statny.dozor@pdp.gov.sk, www.dataprotection.gov.sk.

21.Marketing

As of the date of this Policy, Loopsee does not send marketing emails, newsletters or marketing push notifications and does not use profile data for personalised marketing. If we introduce marketing processing in the future, we will provide the relevant information, legal basis and necessary choice or consent mechanisms before it begins.

22.Cookies and Website Technologies

Information about the use of cookies and similar technologies on the Loopsee website is set out in the separate Cookie Policy and in the cookie settings on the website.

23.Changes to This Policy

We may update this Policy from time to time, in particular if the way the Application operates, the technologies used or legal requirements change. If a significant change materially affects the way personal data is processed, we will inform users appropriately before it takes effect, where the nature of the change allows. If the purpose changes or the scope of processing based on consent is materially expanded, we will not begin the relevant processing without obtaining any new consent required.

24.Contact and Effective Date

Questions about personal data protection and requests to exercise your rights may be sent to: gdpr@getloopsee.com.

Effective date: 13 October 2026