Who this policy covers
Loopworks AI (the "Service", at app.loopworksai.com) is software that businesses use to answer and manage enquiries from their own customers. This policy covers three groups of people:
- Customers: businesses and the people in their team who create an account and use the Service.
- Leads: people who message a customer on WhatsApp or through a customer's website chat.
- Visitors: people who visit this website.
For account and billing data, we decide how the data is used and act as the data fiduciary (controller). For lead conversations and contact details, the customer decides why the data is collected; we process it on the customer's behalf and on their instructions. Leads who want to exercise their rights should contact the business they messaged first; we will help that business respond.
Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a one-way hash) or Google account ID if you sign in with Google, workspace name, time zone, team members and roles | You, when you sign up or invite your team; Google, if you sign in with Google |
| Lead and conversation data | Lead name, phone number, messages, stage, notes, booked meetings | Leads, through the customer's connected channels; the customer's team |
| Knowledge content | Documents and text you upload so the agent can answer questions | You |
| Connected account data | WhatsApp Business account and phone number IDs and access tokens; Google account email and tokens; your AI provider API key | You, when you connect a channel or provider |
| Google user data | Calendar availability and the events the agent creates; rows in the spreadsheet you choose | Google APIs, with your permission (see below) |
| Billing data | Invoices, payment status, PayU transaction reference | You and PayU. We never receive your full card or bank details. |
| Technical data | IP address, browser type, request logs, security events | Automatically, when you use the Service or this website |
How we use data
- To provide the Service: receive and send messages on your connected channels, generate AI replies, qualify and stage leads, sync to Google Sheets, check availability and book meetings on Google Calendar, and send follow-ups you have enabled.
- To run your account: sign-in, team access, invoices and payment confirmation.
- To keep the Service secure and reliable: rate limiting, abuse prevention, error monitoring and backups.
- To contact you about your account, billing, security notices and changes to these policies.
We do not sell personal data. We do not use lead or conversation data for advertising. We do not use customer data to train AI models.
AI processing
To write replies, the Service sends the relevant conversation, your agent instructions and matching parts of your knowledge base to the AI provider you select in Agent settings (Groq, OpenAI or Anthropic), using the API key you provide. That provider processes the data under its own terms and privacy policy, which you accept when you create a key with them. Choose the provider that suits your requirements; you can change or remove it at any time.
Google user data
Loopworks AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Sign in with Google. If you sign in with Google, we receive your name, email address and Google account ID (the openid, email and profile permissions). We use them only to create your account and sign you in. If an account with the same email already exists, it is linked to your Google sign-in only after you confirm that account's password once, or while you are already signed in to it.
Calendar and Sheets. If you choose to connect a Google account for booking and lead sync, we request only these permissions:
calendar.readonlyandcalendar.events: to read your free and busy times so the agent offers only open slots, and to create, update or cancel the meetings it books for your leads.spreadsheets: to write lead rows to the spreadsheet you select, and read it back to keep it in sync.
We use Google user data only to provide these user-facing features inside the Service. We do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your permission, for security purposes, or to comply with the law. We do not use Google user data to develop, improve or train generalised AI or machine learning models. Available time slots may be passed to your chosen AI model only so it can offer them to the lead in the conversation.
You can disconnect Google at any time from Settings in the app, or from your Google account permissions. When you disconnect, we delete the stored Google tokens.
WhatsApp and Meta data
When you connect WhatsApp through the official WhatsApp Business Platform, Meta sends us the messages and contact details of people who message your number, and we send your replies back through Meta. We store your WhatsApp Business account ID, phone number ID and an access token (encrypted) so the Service can act on your behalf. We use this data only to provide the Service to you. You can disconnect a number at any time from Connect in the app. Instructions for deleting data are on our data deletion page.
Who we share data with
We share personal data only with the service providers we need to run the Service, and only for that purpose:
- Amazon Web Services (Mumbai region, India): hosting, database and backups.
- Meta Platforms: delivery of WhatsApp messages, when you connect WhatsApp.
- Google: Calendar and Sheets, when you connect a Google account.
- Your chosen AI provider (Groq, OpenAI or Anthropic): generating replies.
- PayU: processing payments.
We may also disclose data when required by law, to protect the rights and safety of our users or the public, or as part of a sale or reorganisation of the business, in which case this policy will continue to apply.
Where data is stored and how it is protected
The Service and its database are hosted in India (AWS ap-south-1, Mumbai). Some providers listed above may process data outside India. We protect data with:
- HTTPS (TLS) for all traffic, with HSTS.
- Database-level isolation so one workspace cannot read another's data.
- AES-256-GCM encryption for stored access tokens and API keys.
- Passwords stored only as salted one-way hashes.
- Rate limits on sign-in, sign-up and other sensitive actions.
- Least-privilege server access with no public SSH.
No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as required by law.
How long we keep data
- Account, lead and conversation data: for as long as your workspace is active, or until you delete it.
- After a deletion request or account closure: removed from the live database within 30 days, and from backups within a further 14 days.
- Invoices and payment records: kept for the period required by Indian tax law, typically 8 years.
- Server logs: up to 30 days.
Your rights
Under the Digital Personal Data Protection Act, 2023 and other applicable law, you can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct or update inaccurate data;
- erase your data, subject to legal retention requirements;
- withdraw consent you have given, for example by disconnecting Google or WhatsApp;
- nominate another person to exercise these rights if you are unable to.
Email hello@auto4you.in from the address on your account. We will reply within 30 days. If you are a lead, contact the business you messaged, or write to us and we will pass your request to them.
Cookies
The app uses one strictly necessary cookie to keep you signed in. This website sets no cookies. The website chat widget stores a random conversation ID in the visitor's browser so the chat continues after a page reload. We do not use advertising or third-party tracking cookies.
Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.
Changes to this policy
We will post any changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.
Contact and grievance officer
For any privacy question, request or complaint, contact our grievance officer:
Hardik Agarwal
Hardik Agarwal, a sole proprietor trading as Auto4you
Rajasthan, India
Email: hello@auto4you.in
We aim to acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.