Privacy Policy for Loom21

Last Updated: October 8, 2026

Loom21 LTD ("we," "us," or "our") operates Loom21 (the "Service"), a web application that allows users to create accounts, manage products, clients, suppliers, and invoices. We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are

We are Loom21 LTD, a company registered in Bulgaria (UIC/ЕИК 208142174), with its registered address at Aleko Konstantinov 11 str., Tvarditsa, Bulgaria. For the purposes of GDPR, we are the "Data Controller" for the personal data described in this policy, such as your account details. For the business data you store in Loom21 about your own customers and suppliers, you are the controller and we act as your processor, as set out in Section 10.2a of our Terms of Service.

Contact Information:
Submit an inquiry
Email:

2. Information We Collect

We collect and process the following types of personal data when you use our Service:

a. Information You Provide Directly

Account Information: When you create an account, we collect your name, email address, username, password, and any other information you provide (e.g., phone number, company details).
Business Data: Information about your products, clients, suppliers, and invoices, which may include personal data such as names, contact details, or financial information (e.g., billing addresses).
Communications: Any information you provide (e.g., name, email, message) when contacting us via our contact form, which we process to respond to your inquiries or requests.

b. Information Collected Automatically

Usage Data: Information about how you interact with the Service, such as IP address, browser type, device information, pages visited, and timestamps.
Cookies: The loom21.com website does not use tracking or advertising cookies, and our website analytics (Simple Analytics) are cookieless. The Loom21 application uses only the cookies or local storage strictly needed to keep you signed in and remember your settings.

c. Information from Third Parties

If you integrate third-party services (e.g., payment processors like Stripe), we may receive limited data from these providers, subject to their privacy policies.

3. Legal Basis for Processing (GDPR)

Under GDPR, we process personal data based on the following legal grounds:

Consent: Where you have given explicit consent (e.g., for marketing emails).
Contract: To fulfill our obligations under the Service agreement (e.g., providing access to your account and managing your inventory data).
Legitimate Interests: For purposes such as improving the Service, ensuring security, or preventing fraud, where our interests do not override your rights.
Legal Obligation: To comply with applicable laws, such as tax or reporting requirements.

4. How We Use Your Information

We use your personal data for the following purposes:

To Provide and Operate the Service:
- Create and manage your account.
- Process and store your inventory, client, supplier, and invoice data.
- Facilitate invoicing and related functionalities.
To Improve and Personalize the Service:
- Analyze usage patterns to enhance functionality and user experience.
- Tailor content or features to your preferences (where permitted).
To Communicate:
- Send you transactional emails (e.g., account confirmations, password resets).
- Respond to your inquiries or support requests submitted via our contact form.
- Send marketing communications (with your consent, where required).
To Ensure Security:
- Detect and prevent fraud, unauthorized access, or other illegal activities.
- Maintain the integrity of the Service.
To Comply with Legal Obligations:
- Meet regulatory requirements, such as tax reporting or data protection laws.

5. How We Share Your Information

We do not sell your personal data. We may share your data in the following circumstances:

Service providers (sub-processors): We use the providers below to run the Service. Each one processes personal data only on our instructions and under a data processing agreement that meets GDPR requirements. We will update this list at least 30 days before adding or replacing a provider.

Provider	Purpose	Data location
Microsoft Ireland Operations Ltd (Microsoft Azure)	Hosting of the Loom21 application, website and database	Application servers: United States (West US 2). Database: EU (North Europe, Ireland)
Microsoft Ireland Operations Ltd (Azure Email Communication Services)	Sending account emails (sign-up confirmation, password reset, notifications) and replies to contact-form messages	United States
Stripe Payments Europe, Ltd.	Card payments for Loom21 subscriptions	EU (Ireland); some data transferred to the United States under Standard Contractual Clauses
Simple Analytics B.V.	Cookieless, anonymous visit statistics for loom21.com (no personal data, no cookies)	EU (Netherlands)

Payment processors that you connect to receive payments from your own customers — such as Stripe (your own account), BTCPay Server, Glow or other Lightning Address wallets, Speed Wallet and LNbits — are not our sub-processors. You choose them, your customers pay them directly, and their own terms and privacy policies apply. Loom21 never holds your funds.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity, subject to applicable data protection laws.
Legal Requirements: If required by law, regulation, or legal process (e.g., court orders, subpoenas), we may disclose your data to authorities.
With Your Consent: Where you explicitly agree to the sharing of your data.

6. International Data Transfers

We host the Service with Microsoft Azure. Our database is stored in the EU (North Europe, Ireland), but the application servers run in the United States (West US 2), so personal data is processed there. Account emails are sent through Azure Email Communication Services, whose data is stored in the United States. Stripe is also headquartered in the United States and may transfer limited data there. Where personal data leaves the European Economic Area (EEA), we rely on safeguards such as:

Standard Contractual Clauses (SCCs): For transfers outside the European Economic Area (EEA).
Adequacy Decisions: Where the recipient country is deemed to have adequate data protection by the European Commission.
Other Safeguards: As required by local laws (e.g., Binding Corporate Rules for intra-group transfers).

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. For example:

Account and business data is kept while your account is active. After you close your account, you can still export your data for 30 days; after that we delete it. Invoices and records we are legally required to keep (for example our own invoices to you, for tax purposes) are kept for up to 10 years.
Usage data may be retained for 2 years for analytics or security purposes.
You may request deletion of your data (see Section 8).

8. Your Data Protection Rights

Depending on your location, you may have the following rights under GDPR and other applicable laws:

Access: Request a copy of the personal data we hold about you.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion of your data (subject to legal obligations).
Restriction: Restrict processing of your data in certain circumstances.
Portability: Receive your data in a structured, machine-readable format.
Object: Object to processing based on legitimate interests (e.g., marketing).
Withdraw Consent: Withdraw consent at any time, where processing is based on consent.
Lodge a Complaint: Contact a supervisory authority (e.g., in the EU, your local Data Protection Authority) if you believe we have violated your rights.

To exercise these rights, use our contact form. We will respond within 30 days for GDPR, or as required by local law. contact form.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption of data in transit and at rest.
Secure authentication mechanisms.
Regular security assessments and updates.

However, no system is completely secure, and we cannot guarantee absolute security. Please notify us immediately via our contact form if you suspect unauthorized access to your account. contact form.

10. Third-Party Links

Our Service may contain links to third-party websites or services (e.g., payment processors like Stripe). We are not responsible for their privacy practices. Please review their privacy policies before providing personal data.

11. Children’s Privacy

Our Service is not intended for individuals under 16. We do not knowingly collect personal data from children. If you believe we have collected such data, please use our contact form to request deletion. contact form.

12. Compliance with Other Laws

In addition to GDPR, we strive to comply with other applicable data protection laws, such as:

CCPA (California, USA): If you are a California resident, you may have rights to access, delete, or opt out of the sale of your data. We do not sell data, but you can exercise other rights by contacting us.
PIPEDA (Canada): We ensure fair information practices for Canadian users.
LGPD (Brazil): We comply with Brazil’s data protection requirements.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or a notice on the Service. The updated policy will be effective as of the "Last Updated" date.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Contact Form:Submit an inquiry

For GDPR complaints, you may also contact your local Data Protection Authority.