Sign inSign up today

Privacy Policy

Last updated 25 October 2026

In short. Keeplooped helps local businesses answer leads, book appointments and keep clients. We store the information businesses put into Keeplooped and the messages they send through it. We do not sell personal data, we do not share mobile numbers for anyone else's marketing, and we do not use your data to train AI models.

1. Who we are

Keeplooped is operated by Focus Digital d.o.o. (OIB 78356705721), Borongajska cesta 82/3, 10000 Zagreb, Croatia ("Keeplooped", "we", "us"). This policy explains what personal data we handle, why, and what you can do about it. Questions, or requests to use any right described here: privacy@keeplooped.com.

2. Two roles: controller and processor

  • Businesses that use Keeplooped (our customers) put in data about their own clients and leads: contacts, messages, bookings, loyalty points, reviews. For that data the business is the controller and Keeplooped is its processor. We handle it only to run the service for that business, under our Data Processing Agreement. If you are a client of a business that uses Keeplooped, contact that business first about your data; we will help them respond.
  • For our own customers' account data, our website visitors, partners and people we contact about Keeplooped, we are the controller. The rest of this policy mainly covers that data.

3. What we collect

  • Account data: name, email, phone number, business name, role, sign-in identifiers.
  • Business profile: business name, address, hours, services and public details we look up at sign-up from Google Places.
  • Customer content: the contacts, conversations, messages, calls, bookings, workflows, offers, loyalty and review data your business stores in Keeplooped.
  • Consent records: when and how a contact agreed to texts or emails, the wording they saw, and every opt-out. Kept as evidence for the business.
  • Billing data: plan, invoices and payment status. Card details are handled by Stripe and never reach our servers.
  • Technical data: IP address, browser, device, pages visited, error logs.
  • Partner data: name, company, contact details and payout details for people in our partner program.
  • Calls: when someone calls a business's Keeplooped number we log the caller's number, time, duration and outcome. Callers who are not answered can leave a voicemail, which is recorded for the business. A business may choose to record answered calls; this is off by default and never happens when either side is in a state that requires everyone's consent. A business may also send one automatic text to a caller it missed.
  • Prospects: business contact details from public listings and our own lists, which we use to contact businesses about Keeplooped by email and phone. Our sales calls may be recorded where the law allows.

4. How we use it

  • To provide Keeplooped: storing data, sending the texts, emails and calls a business instructs, booking appointments, running workflows, reports and AI replies.
  • To enforce messaging rules: consent checks, quiet hours, opt-out handling and carrier registration for business phone numbers.
  • To bill customers and pay partners.
  • To keep the service secure, prevent abuse and fix problems.
  • To tell you about changes to the service, and, where you agreed, about new features and offers.
  • To measure and improve our website and advertising (see section 10).

Legal bases (GDPR): contract for providing the service and billing; legitimate interests for security, fraud prevention, improving the product and contacting businesses about Keeplooped; legal obligation for tax and messaging records; consent for marketing email, website cookies and connected accounts. You can withdraw consent, and object to direct marketing, at any time.

5. Text messages and mobile numbers

  • We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except the service providers that deliver the messages.
  • Messages a business sends through Keeplooped are sent in that business's name. The business decides what to send; our Communications Terms set out its responsibilities.
  • Anyone can reply STOP to stop texts and HELP for help. See our SMS terms for texts Keeplooped itself sends.

6. AI features

AI replies and drafting send the relevant business facts and conversation to our AI provider (Anthropic) to produce a response. A business can also let an AI assistant answer incoming texts in its name, using only that business's facts; it says it is automated if asked and hands the conversation to staff when needed. That content is used only to produce the result and is not used to train the provider's models. AI features are off until a business switches them on.

7. Google accounts and other connected services

A business can connect its own accounts to Keeplooped. When it does, we use what those services share only to provide the feature the business switched on:

  • Google Business Profile: we read the business's reviews and post the replies the business approves. We do not change the listing itself.
  • Google Calendar: for a staff member who connects their Google Calendar, Keeplooped adds, updates and removes the calendar events for the Keeplooped bookings assigned to that staff member. It reads only the busy times in their calendar, so they are not booked over them, and never reads or keeps the titles, descriptions or guests of their other events. When a client is invited to a booking, Google sends them the invitation from the staff member's calendar.
  • Mindbody: clients, visits, bookings, memberships and sales, and we add new clients the business's leads create.

Keeplooped's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and people at Keeplooped do not read it except with the business's permission, for security, or where the law requires. We do not share or transfer Google user data to third parties, except service providers needed to run these features (hosting and database, bound by contract), to comply with law, or as part of a merger or sale with notice.

When a Google account is disconnected, we stop syncing and delete the Google data we stored for it within 30 days. You can remove Keeplooped's access at any time at myaccount.google.com/permissions; we treat that the same as disconnecting.

8. Who we share data with

We do not sell personal data. We share it only with service providers that help us run Keeplooped, each bound by contract to protect it. For Google user data, the narrower rules in section 7 apply. Our service providers:

  • Clerk: sign-in and user management
  • Neon: database hosting
  • Render and Vercel: application and website hosting
  • Twilio: text messages and phone calls
  • SendGrid and Resend: email delivery
  • Stripe: payments
  • Anthropic: AI features
  • Google: business profile lookup (Places), website analytics, and the Google accounts a business connects (section 7)
  • Mindbody: when a business connects its Mindbody account (section 7)
  • Meta: website advertising measurement, including a sign-up event sent from our server when you have allowed advertising cookies

We may also disclose data when the law requires it, to carriers and regulators investigating messaging complaints, or as part of a merger or acquisition, in which case we will tell you first.

9. International transfers

We operate from the European Union and use providers in the EU and the United States. Where personal data leaves the EEA we rely on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

10. Cookies and analytics

On keeplooped.com we use Google Analytics and the Meta pixel to understand traffic and measure our advertising, plus our own first-party analytics. These set cookies and share usage data such as pages visited, device and approximate location with Google and Meta. Visitors in the EU, EEA, UK and Switzerland are asked first, and these cookies are only set after you click Accept. You can change your choice at any time with the "Cookie choices" link at the bottom of every page. The app itself uses only the cookies needed to sign you in and keep you signed in.

11. How long we keep data

  • Account and customer content: for as long as the account is active, then deleted or anonymised within 90 days of closing, unless the business exports it first.
  • Messaging and consent records: at least 5 years, because businesses and carriers need them as evidence and the law expects them to be kept.
  • Billing records: as long as tax and accounting law requires.
  • Backups are purged on a rolling schedule and are never restored to serve deleted accounts.

12. Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or object to our use of your data, and to receive it in a portable format. Write to privacy@keeplooped.com; we respond within 30 days. You can also complain to your local data protection authority (in Croatia, AZOP, azop.hr). We have not appointed a Data Protection Officer; privacy@keeplooped.com reaches the person responsible. How to delete your data: Data deletion.

US residents. If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Utah), you can ask what personal data we hold about you and have it accessed, corrected or deleted. We do not sell personal data for money. Google Analytics and the Meta pixel may count as "sharing" for targeted advertising under some state laws; you can opt out by turning on Global Privacy Control in your browser, which we honor, or by writing to us. We will not treat you differently for using these rights.

13. Security

Data is encrypted in transit and at rest. Each business's data is kept separate by the database itself, not only by the app. Access to production systems is limited to people who need it. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

14. Children

Keeplooped is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16 for our own purposes.

15. Changes

If we make a material change, we will email account owners and update the date at the top of this page before it takes effect.