Looped
Log in Get started
Log in Get started

Privacy Policy

Last updated: 10/09/2026

1. Who we are

Looped is operated by James Binks, trading as Looped ("Looped", "we", "us", "our"). Looped is a B2B lead generation platform available at leads.looped.ltd.

We are the data controller for the personal data described in this policy. If you have any questions, contact us at james@looped.ltd.

2. Scope of this policy

This policy explains how we collect, use, and protect personal data in two distinct situations:

  • Data about our customers — the people and businesses who sign up to use Looped.
  • Data about third-party individuals — the decision-makers and business contacts that our customers search for and find using Looped. These individuals are not our customers, have not signed up for Looped, and in most cases will not have heard of us before.

We treat these two categories differently throughout this policy, because the way we collect the data, and the legal basis for processing it, is different for each.

3. Data we collect about our customers

When you create a Looped account and use our service, we collect:

  • Your email address, name, and password (stored as a secure hash, never in plain text)
  • If you sign in with Google, your Google account ID, email, name, and avatar image
  • Your email verification status
  • Your subscription plan, credit balance, and credit transaction history, including which campaigns credits were spent on
  • Your Stripe customer ID and subscription ID, so we can manage your billing (we do not store your card details ourselves; these are held by Stripe)
  • Account activity timestamps (created, last login)

4. Data we collect about third-party individuals (leads)

Looped's core function is helping our customers find and verify contact details for business decision-makers. When a customer runs a search, we build and store records containing:

About the company: name, website, domain, industry classification, location, company size, phone number, general email address.

About individual people at that company: full name, job title, seniority level, business email address, phone or mobile number, LinkedIn profile URL, a verification/confidence status for each field, and whether the record has been flagged "Do Not Contact."

We keep a record of which source supplied each individual field, so we always know where a piece of data came from.

Where this data comes from

We do not collect this data directly from the individuals concerned. Instead, we compile it from a combination of:

  • Official government company registries, including UK Companies House, the Australian Business Register, the New Zealand Business Number register, France's INSEE/SIRENE, Denmark's CVR, Switzerland's Zefix, Canada's ISED registry, New York State's Socrata open data, Norway's Brønnøysund Register Centre, and Ireland's Companies Registration Office
  • Google Maps and Google Places, for business location, phone, and website data
  • Apollo.io, a third-party contact enrichment provider, for verified emails, phone numbers, LinkedIn URLs, and Do Not Contact status
  • Automated web search (via OpenAI's models), for company and contact details that are otherwise publicly available online

We do not fabricate, guess, or pattern-generate any contact detail. If genuine data cannot be found for a field, we say so rather than inventing a plausible-looking value.

Our legal basis for processing this data

Because individuals in our leads database have not given us their data directly and have not consented to being included, we rely on legitimate interests (UK GDPR / EU GDPR Article 6(1)(f)) as our legal basis. We consider this appropriate because:

  • The data is limited to business contact information used in a professional, not personal, context
  • We only source information that is already publicly available or held by data providers operating lawfully in this space
  • The processing supports legitimate B2B commercial activity that individuals in senior or decision-making roles can reasonably expect
  • We provide a clear, accessible way for any individual to ask us to remove their data (see Section 8)
  • We honour any "Do Not Contact" signal we receive from our data providers

Why we don't individually notify every person in our database

UK and EU GDPR (Article 14) generally require that, when we obtain personal data indirectly rather than from the individual, we provide that individual with certain information about the processing. The law recognises an exemption where doing so would involve disproportionate effort (Article 14(5)(b)), which applies here given the volume and nature of business contact records we process. Where this exemption applies, we are instead required to take appropriate measures to protect the individual's interests, including making this information publicly available. This Privacy Policy, and the removal request process described in Section 8, are how we meet that requirement.

5. How we use this data

We use customer data to operate your account, process billing, provide customer support, and improve the service.

We use lead data to power the core product: letting our customers search for, view, and export business contacts that match criteria they specify.

We do not sell personal data to third parties. We do not use lead data for our own marketing purposes.

6. Who we share data with

We share data with the following categories of processor, strictly to operate the service:

Who What we share Why
Apollo.io Company name, domain, contact name To obtain verified contact details
Google (Maps/Places, OAuth) Company name and location, or your Google profile if you sign in that way Location data lookup; sign-in
OpenAI Search criteria, company names To power search and enrichment features
Stripe Your email, user ID, plan details Payment processing and subscription management
SendGrid Recipient email, name, and transactional content Sending account emails (verification, password reset)
Government company registries (see Section 4) Company identifiers To retrieve official company data

We do not use any analytics, advertising, or tracking services. We have checked our codebase thoroughly and confirm there are no third-party analytics or tracking scripts (such as Google Analytics, Meta Pixel, or similar tools) anywhere on our platform.

7. International data transfers

Several of the processors listed above, including Apollo.io, OpenAI, Google, and SendGrid, are based in, or process data in, the United States. Where we transfer personal data outside the UK or EU, we rely on appropriate safeguards recognised under UK and EU data protection law, such as Standard Contractual Clauses, to the extent applicable to each processor.

8. Your rights, and how to exercise them

If you are a Looped customer

You can view and update most of your account details directly within the app. You can permanently delete your account, and all associated data, at any time from Settings. This action is immediate and cannot be undone.

If you are an individual found in our leads database, and not a Looped customer

You have the right to ask us what data we hold about you, and to ask us to correct or delete it. You can submit a request at any time at:

leads.looped.ltd/pages/data-removal-request.html

Requests submitted through this page are reviewed by our team individually. This is a manual process, not an instant deletion, and we aim to respond within 30 days, in line with our obligations under UK and EU GDPR.

Your rights under UK/EU GDPR

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request erasure of your data
  • Restrict or object to our processing
  • Receive a portable copy of your data, where applicable
  • Lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk)

To exercise any of these rights, contact us at james@looped.ltd, or use the removal request page above if your request relates to lead data.

9. Data retention

We retain customer account data for as long as your account remains active. We retain lead data for as long as it remains part of an active campaign. If you delete a campaign, its associated company and contact records are deleted along with it. We do not currently apply an automatic time-based deletion schedule beyond this. Data persists until you delete it, your account is deleted, or we act on a data removal request.

10. Security

We take reasonable technical and organisational measures to protect personal data, including hashing passwords, using secure session cookies, and restricting access to data on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Cookies

Looped uses only one cookie, which is strictly necessary to keep you logged in. See our Cookie Policy for full detail.

12. Children

Looped is not intended for use by anyone under the age of 18, and we do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the "last updated" date above.

14. Contact us

james@looped.ltd
Correspondence address: [to be confirmed]

Looped
AI-powered B2B lead generation. Find, qualify, enrich, and export your next pipeline. In minutes.
Product
Pricing
Company
About Contact
Legal
Privacy policy Terms of service Cookie policy
© 2026 Looped. All rights reserved.
Privacy Terms Cookies