Introduction

This Policy explains how Personal Data is collected, processed, used, and protected when visiting LoopChat, creating an account, or using the Platform and its services. LoopChat processes data only for lawful, disclosed purposes and in accordance with the Saudi Personal Data Protection Law and its implementing regulations.

Entity

LoopChat Company – Single-Person Limited Liability Company (Holding)

Commercial Registration

7052815540

VAT Number

314455476400003

Registered Office

King Faisal District, Prince Bandar bin Abdulaziz Road, Riyadh 13215, Kingdom of Saudi Arabia

Scope

This Policy applies to the LoopChat website, Platform, and digital interfaces; account holders and Customer Users; and data processed for Customers through contact, conversation, channel, campaign, reporting, billing, and enabled integration services. It does not govern the independent practices of external platforms or websites, which are subject to their owners’ policies.

Definitions and Processing Roles

Customer means the company, organisation, or entity subscribing to LoopChat. User means a person authorised by the Customer to create an account or access or use the Platform. Data Subject means the natural person to whom Personal Data relates. Customer Data means data and content entered or connected by the Customer or its Users, including contacts, conversations, messages, and attachments.

LoopChat is a controller for data whose processing purposes and means it directly determines, including registration, subscription, billing, support, and Platform-security data. For the Customer’s customers, contacts, and conversations, the Customer is controller and LoopChat processes on its behalf under documented instructions, unless applicable law requires a different role for particular processing.

Categories of Data We Process

• Account and contact data: name, email, telephone number, entity name, country, address, account settings, plan, and permissions.

• Entity and verification data: registration, entity, address, and documents supplied for registration or verification where required.

• Usage and security data: IP address, browser and device type, operating system, access times, sessions, activity, error and performance logs, and login attempts.

• Contact data: names, contact details, identifiers, classifications, and information imported, added, or received through channels.

• Conversation and channel data: messages, attachments, account identifiers, timestamps, message status, and interaction data needed to operate a channel.

• Subscription and billing data: plan, amounts, currency, transaction status, number and date, invoices, and related operating credit.

• Support data: correspondence, support requests, files, and information supplied to resolve a request.

LoopChat does not ask Users to enter sensitive data that the Service does not require. Customers should avoid uploading unnecessary data and must ensure an appropriate lawful basis before processing sensitive data through their account.

Data Sources and Collection

Data is collected directly from Users during registration, account updates, support, or payment; from Customers and Users when entered, imported, or uploaded; from channels and services the Customer elects to connect within granted permissions; automatically through operational and security logs and necessary cookies; and from official or lawfully available sources where needed for verification or compliance.

At collection, as appropriate, we identify whether information is mandatory or optional. Failure to provide mandatory data may prevent account creation, feature activation, subscription completion, or certain support.

Processing Purposes

• Create, administer, and verify accounts and manage Users, roles, and permissions.

• Provide Platform functions, including contact, conversation, channel, workflow, and reporting management.

• Execute campaigns and messages created by the Customer according to its settings and instructions.

• Manage subscriptions, billing, payments, and operating credit.

• Provide support and communicate about accounts, maintenance, updates, and security.

• Protect the Platform, prevent fraud and misuse, and investigate incidents.

• Measure performance, diagnose errors, and improve stability and functions using the minimum data necessary.

• Meet legal and contractual obligations, evidence transactions, and protect rights.

Lawful Basis

LoopChat relies on the appropriate lawful basis for each purpose, including contract performance, compliance with a legal obligation, consent where required, legitimate interests after confirming that Data Subject rights are not adversely affected and that the processing does not concern sensitive data, or another basis permitted by law. General acceptance of this Policy does not replace separate, express consent where law requires it for a specific purpose.

Customer Data and Conversations

LoopChat processes contacts, conversations, messages, and attachments only as needed to display, manage, answer, classify, report on, and automate them as enabled by the Customer. LoopChat does not acquire ownership of Customer Data or content and does not use it independently of providing the Service, security, or legal compliance.

The Customer is responsible for lawfully collecting, entering, and connecting its customers’ data, issuing notices, obtaining necessary consents, and responding to Data Subject requests as controller. Within reasonable and technically available limits, LoopChat assists the Customer with those obligations.

External Channels and Integrations

LoopChat enables connections to external services through official authorization mechanisms and processes access tokens and data only within the permissions required to operate the relevant service. The use of data received through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. When a Google account is disconnected, the Platform permanently deletes all Access and Refresh Tokens and data retrieved from Google services. External services remain subject to their respective terms and privacy policies.

Campaigns and Direct Marketing

LoopChat supplies technical tools for campaigns through supported channels under Customer instructions. The Customer is responsible for lawful recipient lists and content, required consents, opt-out requests, laws, and channel policies. Platform execution does not approve campaign content or assume responsibility for the Customer’s lawful basis.

LoopChat marketing to account holders is sent under an appropriate lawful basis with an unsubscribe method where required. Opting out of marketing does not stop necessary security, billing, or account service messages.

Payment and Billing

Payments and financial refunds are handled by an approved payment service provider. LoopChat does not seek to store full card information or sensitive verification codes. It may receive transaction reference information such as name, reference number, amount, currency, status, and date for subscription, billing, accounting, and compliance. Wallet credit, if available, is operating credit within the Platform—not a bank account or money-transfer facility.

Cookies

The Platform uses necessary cookies for login, session protection, preference retention, and core operation. Analytics or preference cookies may be used where enabled and after applicable notice or consent requirements. Users can manage non-essential cookies through the consent tool or browser settings; disabling necessary cookies may impair the Platform.

Service Providers and Disclosure

LoopChat does not sell or rent Personal Data or make it available for another party’s independent purposes. It may provide the minimum necessary data to categories of providers acting for it or delivering a Customer-requested service, including hosting and infrastructure, payments, email and messaging, performance monitoring, security, and technical support. They must maintain confidentiality and security and restrict use to the specified purpose.

Operating a provider or channel under LoopChat or Customer instructions gives that provider no independent right in the data. Disclosure may also occur to the extent required by law or an order of a competent authority, or otherwise permitted by law, with documentation and limitation to what is necessary.

Data Location and Transfers Outside Saudi Arabia

LoopChat’s principal databases and infrastructure are hosted in the Kingdom of Saudi Arabia, and databases stored by LoopChat are not transferred outside the Kingdom as part of the Platform’s core operation.

A Customer-enabled External Channel or integration may require limited data exchange with its owner according to its technical architecture. Any transfer constituting a transfer of Personal Data outside the Kingdom occurs only as necessary and after meeting applicable legal requirements, including purpose limitation, data minimisation, and required safeguards. The Customer’s independent use of an External Channel is also subject to that provider’s terms and processing locations.

No Sale of Data and Artificial Intelligence

LoopChat does not sell User or Customer data, create independent advertising profiles from it, or use conversation content or Customer Data to train general-purpose AI models or serve other parties. Where a Customer activates an AI-assisted or automated function, processing is limited to operating the requested function to the disclosed extent, and the technology provider receives no independent right to use the data.

Retention and Disposal

LoopChat retains data only as long as necessary for the collection purpose, legal, accounting, or security obligations, or establishment of rights. Periods depend on data type, account nature, Customer settings, and law, and cover account and subscription, billing, support, security logs, contacts, conversations, and backups.

When the purpose ends and no lawful retention basis remains, data is securely deleted, destroyed, or anonymised. A limited copy may remain in backups until the ordinary deletion cycle ends, with restricted use and no return to production except for lawful restoration.

Data Security and Incidents

LoopChat applies technical and organisational measures appropriate to the data and risks, including access controls, communications protection, session management, tenant separation, security logging, backups, restricted administrative access, and incident response. No electronic system can be guaranteed entirely risk-free; controls are reviewed and vulnerabilities and incidents handled under approved procedures.

For a notifiable data incident, LoopChat contains, investigates, and documents it and notifies the competent authority and Data Subjects or the Customer—as appropriate to the role and incident—where legally required.

Data Subject Rights

Subject to legal conditions and exceptions, Data Subjects have the right to know the justification and purposes for collection and the recipients of disclosure; access their Personal Data and receive a clear, readable copy; request correction, completion, or updating; request destruction where statutory conditions apply and no lawful retention basis remains; withdraw consent where consent is the basis, without affecting prior lawful processing; and complain to LoopChat and then the competent authority.

Exercising Rights and End-Customer Requests

Requests may be sent to info@loopchat.sa and must identify the right and provide information necessary to verify identity. LoopChat responds within the periods and procedures required by law and may refuse or restrict a request where legally permitted, giving reasons where required.

If a request concerns data controlled by a LoopChat Customer, the Data Subject should address that Customer. LoopChat may refer the request or provide technical assistance without disclosing data to an unauthorised person.

Customer and User Responsibilities

• Provide accurate, current information and protect usernames, passwords, and verification codes.

• Manage account Users, roles, and permissions and revoke unauthorised access immediately.

• Do not enter unlawful or excessive data or use the Platform in a manner that violates others’ rights.

• Obtain lawful bases and required consents for contacts, campaigns, and integrations.

• Comply with External Channel policies and direct-marketing and opt-out requirements.

• Notify LoopChat immediately of a lost account or suspected unauthorised access or use.

Policy Updates Contact and Complaints

LoopChat may update this Policy when the Service, technical architecture, or legal requirements change. The revised version and effective date will be published, and Users will be notified of material changes by an appropriate method. An update will not introduce an incompatible new use of data without the required notice or lawful basis.

Privacy email: info@loopchat.sa
Website: https://loopchat.sa
Telephone: 920016274
Address: King Faisal District, Prince Bandar bin Abdulaziz Road, Riyadh 13215, Kingdom of Saudi Arabia.

If a complaint is not resolved satisfactorily, the Data Subject may complain to the Saudi Data and Artificial Intelligence Authority through its official channels.