Last updated: October 19, 2026
Privacy
Responsible person and scope
The person responsible for the project is JULIAN DAVID MORA RAMOS, an individual in Colombia; Loomca is the project’s brand. This person handles data protection requests through the contact email below. This notice describes the approved rules for the MVP focused on web chat. Features depend on enablement; this notice does not certify production provider settings, retention or backups. Publishing it does not replace required authorizations.
Account, security and customer service
Account registration and administration involve email, name if provided, a hashed password, email verification, sessions and recovery requests. Handling questions involves the visitor’s authorization and its version, messages, replies, necessary context, identifiers, dates and service states. Configuration, revisions, usage and technical AI evidence such as tokens, duration, outcome and observed cost are also recorded. The purposes are to provide enabled features, protect access, apply permissions and allowances and manage incidents.
Business information and sources
The administrator supplies information, contacts and text for each assistant and may add text-based PDFs or specific public web pages. Extracted text, provenance and indexes or numerical representations are prepared to retrieve relevant information. Originals are temporary; deleting an original does not by itself delete stored text or its derivatives. Visitor file uploads and imports of past chats or address books are not supported. Do not supply secrets or sensitive data; the service is not intended to request or intentionally process them. Activated and available web assistants automatically appear in a public directory with their published display name and description, chat link and, where applicable, a notice identifying the domain allowed for their widget. Pausing them or losing availability removes their entry on the next request; third parties may retain copies.
Responsibilities and human access
Loomca manages its own processing for access, security and service administration. The business decides what information to supply and the purposes of its customer service; it must have the necessary rights and authorizations. Controller and processor roles for each operation depend on who decides the processing and the applicable agreements. Information and permissions are separate for each assistant, even within the same Team or account. Human access by Loomca to content for support requires recorded authorization for a specific case, limited scope and expiry; metrics do not grant general permission to read content.
AI, providers and training
Queries, necessary context and relevant source excerpts may be sent to generation and embedding providers through Vercel AI Gateway. Selection allows alternative models or routes; no single provider or zero retention is promised. During the MVP, those providers may use content for training under their terms and applicable authorizations. Technically allowing this does not demonstrate that training occurs or itself authorize third-party data. Customer service requires the relevant notice and authorization; a change of purpose requires review and new authorization where necessary. This document does not demonstrate that consent has already been obtained.
External services and international processing
Operation may require hosting, a database, email, AI, payments and technical services. The prepared payment flow uses PayPal: full payment method details are entered with the provider; Loomca retains the references, amounts, currency, authorizations, dates and states needed to manage payments and reconciliation. Processing may occur outside Colombia. Actual recipients, countries, agreements and retention for each route require operational verification; this page does not demonstrate those agreements or Live enablement. Processing on behalf of a controller and transfers for a recipient’s own purposes require separate assessment. References to Meta/WhatsApp, catalog or tickets apply only when enabled or where data from earlier use remains.
Cookies, storage and analytics
Administrative access uses an HttpOnly session cookie, with Secure on HTTPS and protection against unauthorized requests; the credential is not stored as a token in local storage. The browser may retain language and appearance preferences, assistant selection and signup intent. The frontend integrates Contentsquare for analytics outside localhost; the embedded widget entry is independent of that integration. Analytics is not claimed to be anonymous, cookie-free or covered by verified consent: capture, masking, recipients, retention and choice controls require verification. Technical reporting through Sentry depends on configuration. Contact links open email and access-related communications depend on the configured sending service.
Content retention
Approved rules set up to 90 days from closure for general conversations and closed commercial requests. When an active period ends without another valid period, configuration and unexpired history have a recovery window of up to 30 days; the earliest relevant expiry applies. Stopping payment alone does not trigger that period if a valid Free modality continues. Open requests are retained only while needed for actual handling. Tickets and their history, where present, do not automatically expire through age or closure, but remain subject to purpose, rights and account deletion. This exception does not extend to all conversations.
Temporary data, payments and backups
Work inputs and technical session context have their own periods of up to 24 hours; these are not the retention period for all history. Source originals, drafts, authorizations, security records and deletion markers have separate purposes and periods. Following account deletion, the technical policy calls for deletion of minimal financial evidence 30 days after all effects have been resolved; an unpaid balance or uncertain result does not start that clock and requires follow-up and justification. This is not a guarantee of tax compliance. Product periods do not certify effective purging in production, backups or providers: execution and applicable exceptions require verification, and simultaneous deletion of every copy is not promised.
Your rights and how to exercise them
You may learn about, access free of charge, update and correct your data, request proof of authorization and information about its use and request withdrawal or deletion where applicable. Write to the responsible person’s email below, explain your relationship with Loomca or the business you contacted and specify your request. You do not need an account to exercise rights over your visitor data. Your connection to the data will be checked using proportionate, minimal information. Do not send passwords, tokens, identity documents or complete conversations in the first message. Exceptions to deletion require specific justification and scope.
Inquiries, complaints and changes
Under Colombia’s Law 1581 of 2012, inquiries have a response period of 10 business days from receipt, extendable by up to 5 additional business days with notice and reasons. Complaints have 15 business days from the day after receipt, extendable by up to 8 additional business days with notice and reasons; incomplete requests follow the legal procedure for providing missing information. These are response periods, not a promise of complete deletion within that time. You may approach the Superintendence of Industry and Commerce after completing the applicable inquiry or complaint procedure. Substantial processing changes must be communicated; updating this page does not replace new authorization where needed. The review date does not establish when each database began.