Privacy Notice
Last updated: 20 June 2026
1. Who We Are
Loop House LLC, a Wyoming limited liability company doing business as ConCal, is the controller of personal information described in this Privacy Notice unless we process it solely on a business customer's instructions. Contact: hello@concal.ai; principal business address: 30 N Gould St Ste R, Sheridan, WY 82801; Wyoming filing ID: 2026-002007228. If required because of our activities in the United Kingdom or European Economic Area, we will identify an appointed UK or EU representative here.
2. Information We Collect
- Account and identity data: name, email, profile image, authentication identifiers, organisation, role, and workspace membership.
- Customer Content: prompts, posts, captions, images, designs, brand assets, schedules, comments, messages, and files.
- Connected-account data: platform identifiers, account names, permissions, access tokens, content, comments, inbox data, publishing status, and analytics made available through connected APIs.
- Calendar data: calendar events and metadata accessed through authorised integrations, subject to the scopes shown during connection.
- Billing and transaction data: plan, subscription status, billing address, tax location and tax information, Stripe customer and payment references, invoices, refunds, chargebacks, and related transaction records. Stripe receives and processes full payment-card credentials directly; ConCal generally receives only limited payment and transaction details.
- Usage and technical data: IP address, device and browser data, login events, pages and features used, timestamps, diagnostics, crash logs, cookies, local storage, and security events.
- Communications: support requests, survey responses, sales communications, and feedback.
- Referral and marketing data: referral code, campaign source, click and conversion data, consent records, and email preferences.
- Information from third parties: login providers, payment providers, social platforms, referral partners, fraud-prevention services, and business customers that invite users.
3. How and Why We Use Personal Data
| Purpose | Typical data | UK GDPR legal basis |
|---|---|---|
| Provide accounts, workspaces, publishing, AI, calendars, inbox, and support | Account, content, connected-account, calendar, usage | Contract; legitimate interests; processor instructions |
| Process subscriptions and payments | Billing, transaction, account | Contract; legal obligation |
| Secure the Service and prevent fraud or abuse | Technical, security, account, transaction | Legitimate interests; legal obligation |
| Improve and troubleshoot the Service | Usage, diagnostics, feedback, limited content where necessary | Legitimate interests; consent where required |
| Send service communications | Account, contact, subscription | Contract; legitimate interests |
| Send marketing | Contact, preferences, referral and campaign data | Consent or legitimate interests, subject to applicable law |
| Comply with law and enforce terms | Account, content, transaction, communications | Legal obligation; legitimate interests |
| Create aggregated or de-identified analytics | Usage and product data | Legitimate interests |
4. AI Processing
Prompts, selected Customer Content, and instructions may be sent to contracted AI providers to generate content or perform requested functions. We seek contractual protections limiting provider use of this data. ConCal does not use Customer Content to train public or shared models without consent. AI providers, model choices, regions, and retention practices may change; current subprocessors should be listed on a public subprocessor page. Users should not submit confidential, special-category, or highly sensitive personal data unless the feature expressly supports it and a lawful basis exists.
5. Google and Other API Data
Where ConCal receives information from Google APIs, our use and transfer of that information will comply with the Google API Services User Data Policy, including applicable Limited Use requirements. ConCal uses connected data only to provide or improve user-facing features requested by the user, maintain security, and comply with law. The exact scopes, uses, storage, and deletion behaviour should be described accurately in the product consent screen and this Notice. Similar principles apply to data obtained from other connected platforms.
6. Sharing and Disclosure
- Service providers and subprocessors that provide hosting, databases, authentication, social publishing, AI, payments, email, analytics, support, security, and error monitoring.
- Connected platforms when you instruct us to publish, retrieve, display, or manage information.
- Your organisation, workspace owners, and authorised team members.
- Professional advisers, auditors, insurers, investors, and transaction counterparties under appropriate duties of confidentiality.
- Authorities or other parties where required by law, to protect rights and safety, investigate fraud, or enforce agreements.
- A buyer or successor in connection with a merger, financing, reorganisation, or sale, subject to appropriate safeguards.
We do not sell personal data for money. If future advertising or analytics practices constitute "selling," "sharing," or targeted advertising under applicable US state law, we will provide required notices and opt-out mechanisms before engaging in those practices.
7. International Transfers
Personal data may be processed in the United Kingdom, United States, European Economic Area, and other countries where providers operate. Where required, we use an adequacy decision, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or another approved transfer mechanism, together with supplementary safeguards where appropriate.
8. Retention
We retain personal data only as long as reasonably necessary for the purposes described, including to provide an active account, comply with tax and legal duties, resolve disputes, prevent fraud, and maintain security. Operational schedule: account and Customer Content for the life of the account plus 90 days after deletion; backups for up to 90 additional days; billing and tax records for 6 years; security logs for 12 months; support records for 3 years; marketing records until opt-out plus suppression records as necessary.
9. Cookies and Similar Technologies
We use essential cookies and local storage for authentication, security, preferences, and in-progress work. We will obtain consent before using non-essential analytics, advertising, or cross-site tracking technologies where required. A separate Cookie Notice identifies each cookie, provider, purpose, duration, and category and links to a consent manager.
10. Your Rights
- Access personal data and receive information about processing.
- Correct inaccurate or incomplete data.
- Delete data, subject to lawful exceptions.
- Restrict or object to certain processing.
- Receive portable data where applicable.
- Withdraw consent at any time without affecting prior lawful processing.
- Opt out of direct marketing.
- Complain to the privacy or data-protection regulator in your jurisdiction. UK residents may complain to the UK Information Commissioner's Office, and EEA residents may complain to their local supervisory authority.
- Under applicable US state laws, request access, correction, deletion, portability, and opt out of sale, sharing, targeted advertising, or certain profiling, and appeal a denied request.
Submit requests to hello@concal.ai. We may verify identity and authority. We will not discriminate against a person for exercising applicable privacy rights. Authorised agents may submit requests where permitted by law.
11. California and Other US State Notices
If ConCal meets statutory thresholds or otherwise elects to honour these rights, the categories collected include identifiers; customer records; commercial information; internet or network activity; geolocation at an approximate level; professional information; user content; and inferences derived from usage. Sources and purposes are described above. Recipients include service providers, connected platforms, organisational users, advisers, authorities, and transaction parties. ConCal does not knowingly sell personal information. If ConCal "shares" data for cross-context behavioural advertising, it must provide a "Do Not Sell or Share My Personal Information" link and honour recognised opt-out preference signals where required.
12. Children
The Service is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a minor has provided personal data, contact us so we can investigate and delete it where appropriate.
13. Security
We use measures designed to protect data, such as encryption in transit, access controls, least-privilege permissions, logging, backups, provider review, and secure development practices. Security cannot be guaranteed. Users should use strong authentication, limit permissions, secure connected accounts, and report suspected incidents promptly to hello@concal.ai.
14. Business Customers and Processor Data
A business customer may control personal data uploaded to its workspace, including social content, comments, messages, employee information, or customer information. In those cases, the business customer is the controller and ConCal is its processor. Individuals should direct requests to that customer. ConCal will assist as required under the applicable Data Processing Addendum.
15. Changes to This Notice
We may update this Notice to reflect changes in the Service, providers, or law. We will post the revised version and update the date. We will provide additional notice or seek consent where required for material changes.
16. Contact
Loop House LLC, d/b/a ConCal
A Wyoming limited liability company
Wyoming filing ID: 2026-002007228
Principal business address: 30 N Gould St Ste R, Sheridan, WY 82801
Email: hello@concal.ai
Security: hello@concal.ai
UK supervisory authority for UK residents: Information Commissioner's Office