Effective Date: March 24, 2026 Data Controller: THREAD AND COLORS LTD (UK Registered) Contact: support@loomy.website

1. Information We Collect

To provide social media scheduling services, Loomy collects:

Account Data: Name, email address, and password.

Social Media Data: Access tokens and profile information from platforms you connect (Google, Facebook, Instagram, etc.).

Payment Data: Handled securely via our third-party processors (Stripe/PayPal). We do not store full credit card numbers.

Usage Data: IP addresses, browser types, and cookies to improve site performance.

2. How We Use Your Data

We process your information under the following legal bases:

Contractual Necessity: To manage your account and post content to your social profiles.

Consent: When you explicitly connect a social media account or sign up for our newsletter.

Legal Obligation: To comply with UK tax and accounting laws.

3. Data Retention & Security

Retention: We keep your social media tokens only as long as your account is active. If you delete a connected profile, the associated tokens are purged immediately.

Security: Loomy uses SSL encryption and secure hashed passwords. Your .env and configuration files are protected by server-level security.

4. Your Rights under GDPR

As a user, you have the right to:

Access: Request a copy of the personal data we hold about you.

Rectification: Correct any inaccurate information.

Erasure ("Right to be Forgotten"): Delete your account and all associated data.

Data Portability: Request a download of your scheduled posts and media.

5. Third-Party Data Sharing

We only share data with essential service providers:

Cloud Hosting: Hostinger (Server infrastructure).

Email: Hostinger SMTP (Transactional emails).

Social APIs: Google/YouTube, Meta (Facebook/Instagram) for the sole purpose of publishing your content.