Privacy Notice

1. Who we are

Thompson Whitney LLC, doing business as Advisory 9, is the data controller for personal data processed through Loops. That means we decide why and how your data is used. Contact us at team@advisory9.com.

2. What we collect and why

• Account data — email address, display name, and (if you sign in with Google) your Google account identifier. Used to create and secure your account and to confirm you're on the invite list. Legal basis: performance of our contract with you.
• Your content — tasks, due dates, categories, recurring templates and your weekly focus. Used solely to provide the service to you. Legal basis: contract.
• Voice capture tokens — a private key generated for your Apple Shortcut, plus the text a shortcut submits. Used to add tasks to your list. Legal basis: contract.
• Security and technical data — IP address, device/browser information, sign-in times and error logs. Used to keep accounts secure, prevent fraud and abuse, and diagnose faults. Legal basis: our legitimate interest in a secure, working service.
• Support messages — anything you send us by email. Used to answer you. Legal basis: legitimate interest.
• Subscription status — your plan, renewal date and entitlement flags received from Paddle. Used to unlock paid features. Legal basis: contract and legal obligation (records of sale).

Payment card details are collected and processed by Paddle, not by us. We never see or store your card number.

3. AI processing

On paid plans, the text of a task may be sent to an AI model provider to suggest a Work/Home category. Only the task text is sent — not your name, email or other tasks. It is used to return that suggestion and is not used to train the provider's models. You can avoid this entirely by setting categories yourself.

4. Who we share data with

• Service providers / subprocessors — our hosting, database, authentication and AI-model providers, acting on our instructions.
• Paddle, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where we are required to by law.

We do not sell your personal data or share it for advertising.

5. Other users

Each account's tasks are isolated at the database level by row-level security. No other user — including the account owner who invited you — can read your tasks. An owner can see administrative details only: email, sign-up date, last sign-in, plan, and a count of tasks.

6. International transfers

We are based in the United States and our providers may process data in the US and other countries. Where data is transferred out of the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep your account and content for as long as your account is active. If you ask us to delete your account, we remove your content within 30 days, except where we must keep limited records (for example sales and tax records) for as long as the law requires. Security logs are kept for a short period and then deleted or anonymised.

8. Your rights

Depending on where you live, you may have the right to access your data, correct it, have it erased, restrict or object to processing, receive a portable copy, and withdraw consent where we rely on it. UK and EEA residents may also complain to their supervisory authority. US state privacy laws may give you similar rights, including the right not to be discriminated against for exercising them. Email team@advisory9.com and we'll respond within one month.

9. Security

We use appropriate technical and organisational measures: encryption in transit, encrypted storage at rest, row-level access controls so each account can only reach its own data, hashed credentials, and least-privilege access for administrators.

10. Cookies and local storage

Loops uses only essential cookies and browser storage — to keep you signed in and remember preferences such as your week start day and dismissed reminders. We do not use advertising or third-party tracking cookies. You can clear this storage in your browser at any time, though doing so will sign you out.

11. Children

Loops is not intended for children under 16 and we do not knowingly collect their data.

12. Changes

We'll update this notice when our practices change and revise the date at the top. Material changes will be highlighted in the app.