Last updated 9 August 2026
LoomaIQ is an AI assistant. To answer you, it has to read what you write, and sometimes hand part of it to a model provider that runs the actual model. This policy says exactly what we collect, exactly who else sees it, and what you can make us do about it. There is a table of every third party in the chain further down — we would rather you read that than take our word for anything.
The short version. We collect your email, your name if your sign-in provider gives us one, and everything you put into the assistant. We do not sell it, we do not share it with advertisers, and we set no advertising or analytics cookies — there is exactly one cookie and it keeps you signed in. We do not train any model on your content. Model providers we route to may, on the Free plan; see Training. You can get a copy of your data or have it deleted by emailing privacy@loomaiq.com.
LoomaIQ (“LoomaIQ”, “we”, “us”) provides the LoomaIQ assistant. We are based in Karachi, Pakistan, and we are the data controller for the personal data described here — meaning we are the ones who decide what is collected and why, and the ones you hold responsible for it.
Written enquiries: privacy@loomaiq.com. We answer privacy requests within 30 days.
Everything below is either something you typed, something your sign-in provider handed us, or something the service has to count in order to work. There is no tracking pixel, no data broker, no enrichment from third-party profiles.
| What | Specifically | Where it comes from |
|---|---|---|
| Account | Email address, display name, which provider you signed in with, and — if you used a password — a scrypt hash of it. Never the password itself. | You, or Google / GitHub at sign-in |
| Your content | Chats and messages, projects and their instructions, files you upload (images, documents, audio, video), artifacts the assistant builds for you. | You |
| Memories | Short facts the assistant saves so it does not ask you the same thing twice. Visible and deletable in the Memory view. | Written by the assistant from your chats |
| Actions | When the assistant proposes to do something in the world — send a mail, add a calendar event, run code — we record the tool, the arguments, whether you approved it, and the result. | The assistant, with your approval |
| Usage | Token counts per request, which model answered, which tools ran, timestamps. This is how plan limits are enforced and how we find what is slow. | Automatic |
| Abuse control | For signed-out visitors, a keyed HMAC-SHA-256 hash of your IP address plus a counter. We store the hash, not the address, and it expires within 24 hours. | Automatic |
| Location | Only if you tap the location button. Your coordinates are turned into a place name once, attached to that one message, and cleared afterwards. We do not track you in the background. | You, per message |
| Connected accounts | If you connect Google Calendar, Gmail, Drive, or your own MCP server, we hold the authorisation to reach it and whatever it returns while answering you. | You, per connection |
| If you talk to LoomaIQ on WhatsApp: your phone number and the messages in that thread. | You, via Meta | |
| Server logs | Ordinary operational logs — request paths, status codes, errors, timings. Kept short and used for keeping the thing running. | Automatic |
We do not collect: payment card numbers (a payment processor will hold those when paid plans open, and we will only ever see the last four digits and the outcome), biometric identifiers, government ID, precise background location, contacts, or anything about you from an advertising network.
If the GDPR or UK GDPR applies to you, these are our legal bases:
These are the companies in the chain. Each one is listed because this codebase actually calls it — not because it might one day. Every one is bound to use the data only to provide its service to us.
| Who | What for | What reaches them | Where |
|---|---|---|---|
| Railway | Hosting the app and its database | Everything, at rest | United States |
| Cloudflare R2 | Off-site database backups | Encrypted snapshots | Global |
| Google (Gemini API) | Model answers, speech-to-text, text-to-speech, realtime voice | Your prompt, conversation, attachments, voice audio | United States |
| Google (OAuth) | Sign-in; Gmail / Calendar / Drive if you connect them | Your email and name; connector data on request | United States |
| GitHub | Sign-in; repository search when you ask for it | Your email and name; your search terms | United States |
| OpenRouter | Routing to frontier models on paid plans | Your prompt and conversation | United States |
| NVIDIA (NIM) | Model answers on the Free plan | Your prompt and conversation | United States |
| freellmapi | Routing to free model endpoints | Your prompt and conversation | Varies by endpoint |
| ElevenLabs | Speech fallback when Gemini fails | Text to speak; voice audio to transcribe | United States |
| Composio | Brokering the authorisation for connected accounts | Connector tokens and the calls made through them | United States |
| Meta (WhatsApp Business Cloud) | The WhatsApp channel, if you use it | Your number and that thread | United States / Ireland |
| DuckDuckGo | Web search, when the assistant searches | The search query only | United States |
| Jina AI | Reading a web page, when the assistant opens a link | The URL only | United States / Germany |
| OpenStreetMap (Nominatim) | Turning shared coordinates into a place name | Those coordinates only | Germany |
| Vercel Sandbox | Running code the assistant writes | The code and its inputs | United States |
| Pollinations | Generating an image when you ask for one | The image prompt only | Germany |
Which model provider serves a given message depends on your plan and on which providers are answering at that moment; if one fails we fail over to the next. The assistant tells you which model answered.
Beyond this list, we disclose personal data only: to a professional adviser under a duty of confidence; where a valid legal process compels us, having first satisfied ourselves it is valid and, unless we are forbidden from doing so, having told you; and to an acquirer if the business is sold, in which case this policy travels with the data and you will be told before anything changes.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We have never done either.
LoomaIQ does not train models on your content. We do not fine-tune, we do not build datasets out of your chats, and no employee reads your conversations except where you have asked for support on a specific problem and given us permission for that problem.
We cannot make the same promise on behalf of every model provider we route to, and we are not going to pretend otherwise:
This distinction is the single most important thing on this page for anyone handling confidential material. If you need it in writing for a specific provider, ask us.
Connecting Google Calendar, Gmail, Drive, or an MCP server of your own is entirely optional and always initiated by you. When you connect one:
Where Google user data is involved, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The assistant can also take actions on your behalf — send a message, create an event, run code, publish an artifact. Actions that change something outside a conversation ask you first, unless you have turned on automatic approval for that kind of action. Everything it did is listed in Approvals.
Speaking to LoomaIQ sends audio to a speech provider (Google, or ElevenLabs as fallback) to be turned into text, and sends text back to be spoken. In realtime conversation mode, audio is relayed through our server to Google's live model for the duration of the call.
We do not keep voice recordings. The audio is held in memory for as long as the request takes and then dropped; what persists is the transcript, as a message in your chat, which you can delete. Voice note attachments you upload deliberately are stored like any other file.
One cookie. It is called session, it is cryptographically signed, it is
HttpOnly, Secure and SameSite=Lax, and it lasts 30 days
or until you sign out. Its only job is to keep you signed in.
There are no analytics cookies, no advertising cookies, no third-party trackers, and no fingerprinting. That is why you are not being asked to dismiss a cookie banner: a strictly necessary cookie does not require consent under the ePrivacy Directive, and we do not set any other kind. The app also stores a little state in your browser's local storage — your theme and view preferences — which never leaves your device.
| What | Kept for |
|---|---|
| Account, chats, projects, files, memories | Until you delete them, or until you close your account |
| Usage and action records | 12 months, for billing accuracy and abuse investigation |
| Guest IP hashes | Under 24 hours |
| Server logs | 30 days |
| Backups | Rotating snapshots; deleted content disappears from backups within 35 days |
| Records we must keep by law (e.g. tax) | As long as that law requires |
When you close your account we delete your account and its content from the live database immediately. Backups are the exception — they are immutable snapshots, so deleted data persists in them until the snapshot ages out, which happens within 35 days. We do not restore deleted data from a backup except to recover from a disaster affecting everyone.
We are in Pakistan, our servers are in the United States, and the providers above are spread across the US and the EU. If you are in the EEA, the UK, or Switzerland, your data is therefore transferred outside your region.
For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), together with the technical measures described under Security: encryption in transit everywhere, encryption at rest for backups, and access limited to the people who operate the service. You can request a copy of the transfer terms we rely on for any provider in the table.
Wherever you are, you can ask us to:
Much of this you can do yourself in the app: delete a chat, a memory, a project or a file at any time. For a full export or full account deletion, email privacy@loomaiq.com from your account address and we will complete it within 30 days, usually far sooner. We will not charge you, and we will not make the service worse for you because you asked.
You have the rights in Articles 15–22 GDPR as set out above. You may lodge a complaint with your national supervisory authority — in Ireland the Data Protection Commission, in the UK the Information Commissioner's Office — and you are entitled to do so without going through us first, though we would like the chance to fix it.
We do not make decisions producing legal or similarly significant effects about you by automated means. The assistant generates text and can act on your instruction; it does not score you, rank you, or decide anything about your rights.
In the past 12 months we have collected the categories described in section 2 — identifiers, internet activity, geolocation if you shared it, audio if you used voice, and the contents of your communications with the assistant — for the business purposes in section 3, from the sources in section 2, disclosing them to the service providers in section 4.
We have not sold personal information and have not shared it for cross-context behavioural advertising, including of anyone under 16. You have the right to know, delete, correct, and to non-discrimination for exercising any of them. Email privacy@loomaiq.com; we verify requests by confirming control of the account's email address, and an authorised agent may act for you with written permission.
We handle personal data in line with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016, and intend to comply with the Personal Data Protection Act when it comes into force. Where Pakistani law is less protective than the standard set out in this policy, this policy governs — we apply one standard to everyone rather than the local minimum.
If your country grants you rights we have not named — Brazil's LGPD, Canada's PIPEDA, India's DPDP Act, Australia's Privacy Act, Saudi Arabia's PDPL, the UAE's data protection law — ask, and we will honour them on the same terms. We would rather answer one policy than fifteen.
What we actually do, rather than a list of adjectives:
No system is perfectly secure, and anyone who tells you theirs is should not be trusted with your data. If a breach affects your personal data and is likely to result in a risk to you, we will notify you and the relevant regulator without undue delay and within 72 hours of becoming aware, as the GDPR requires.
Found a vulnerability? Email privacy@loomaiq.com. We will not pursue legal action against anyone reporting a genuine issue in good faith who gives us reasonable time to fix it before disclosing.
LoomaIQ is not for anyone under 16, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.
If we change this policy in a way that materially reduces your protections, we will tell you in the app or by email at least 30 days before it takes effect, so you have time to export your data and leave if you disagree. Smaller corrections take effect when posted, and the date at the top always reflects the current version.
Privacy questions, data requests, complaints, and vulnerability reports all go to privacy@loomaiq.com. A person reads that address.
LoomaIQ, 252-D K.D.A. 1/A, Stadium Road, Karachi, Sindh, Pakistan.