Privacy Policy
1. Introduction
This Privacy Policy applies to CLOOP LTD (company number 17272947), trading as Cloop, incorporated in England and Wales with its registered office at 66 Paul Street, London, EC2A 4NA ("we", "us", "our").
It explains what personal data we collect when you visit our website or use our services, how we use it, and the rights available to you under applicable law.
We are the Data Controller. To exercise your rights or raise a query, contact legal@mycloop.com.
2. Data We Collect
"Personal data" is any information from which a living individual can be identified. We may collect and process the following categories:
Identity: name, title and similar identifiers.
Contact: postal address, email address and telephone number.
Transaction: payment details and records of services purchased.
Technical: IP address, browser type, device and operating system information, time zone and location data.
Usage: how you interact with our website and services.
Communications: your marketing and contact preferences.
Connected Service Content: where you connect a third-party service, the content and metadata from that service that we need to surface your tasks and context (for example messages, meetings, calendar events and documents).
3. How We Collect It
Directly from you: when you submit forms, correspond with us, or enter into a services agreement.
Automatically: through cookies, server logs and similar technologies as you browse our website.
From services you connect: when you link a third-party account (such as Google Workspace, Microsoft / Outlook, Slack, Notion, Linear, GitHub or a meeting-notes assistant), we access the content described above to provide the service.
From third parties: including analytics providers and publicly available sources.
4. How We Use It
We process personal data only where we have a lawful basis to do so:
Contract: to perform or enter into an agreement with you.
Legitimate interest: to operate and improve our business, provided your rights are not overridden.
Legal obligation: to comply with regulatory and statutory requirements.
In practice, this means we use your data to:
(a) register and onboard you as a client;
(b) deliver services and process payments;
(c) manage our relationship with you;
(d) maintain and secure our website and infrastructure;
(e) analyse usage patterns to improve what we offer.
5. Who We Share It With
Service providers: cloud hosting, IT administration and CRM platforms that process data on our behalf.
Professional advisers: solicitors, accountants, auditors and insurers as required.
Regulators: HMRC and other authorities where reporting is required by law.
Our key sub-processors are:
• Supabase: database hosting and storage
• Google Vertex AI (Gemini): AI processing
• PostHog: product analytics
• Resend: transactional email delivery
All third-party processors are contractually bound to handle your data in accordance with applicable law and our instructions.
6. Connected Services
Cloop works by connecting to the productivity and communication services you use. When you connect a service on the Integrations page, we access the content and metadata needed to surface your tasks, projects and the context behind them. Services you can connect currently include Google Workspace, Microsoft / Outlook, Slack, Notion, Linear, GitHub and meeting-notes assistants.
• We access only the account you connect, and only to provide Cloop's features to you.
• We do not sell your data, use it for advertising, or use it to train generalised AI models.
• You can disconnect any service at any time from the Integrations page; on disconnection we delete that service's stored access tokens.
Google Workspace data is subject to the additional commitments set out in the Google User Data section below.
7. Connecting AI Assistants and Other Tools
Cloop offers a Model Context Protocol (MCP) interface that lets you connect third-party AI assistants and tools, such as Claude or ChatGPT, to your Cloop workspace. This is optional and entirely under your control.
• When you authorise a tool, it can read the Cloop data you grant it: your tasks, projects, contacts and the context behind them. It can then help you act on that data at your direction. It cannot browse your connected inboxes or accounts directly.
• Because you are directing your own data to a tool you have chosen, that tool's provider then handles it under its own terms, which we recommend reviewing.
• You authorise this access and can revoke it at any time.
We treat this as you exercising control over your own data. We do not make your data available to any third-party tool unless you connect it.
8. Google User Data
This section discloses how Cloop accesses, uses, stores and shares Google user data when you connect your Google Account. It is provided in compliance with the Google API Services User Data Policy, including the Limited Use requirements.
8.1 Scopes We Request
When you connect your Google Account on the Integrations page, Cloop requests the following read-only OAuth scopes:
userinfo.email and userinfo.profile: to identify your Google account and display your name in the interface.
gmail.readonly (https://www.googleapis.com/auth/gmail.readonly): to read your email messages so Cloop can summarise them and extract your action items into your to-do list. Cloop does not send, draft, modify, label, or delete email.
calendar.events.readonly (https://www.googleapis.com/auth/calendar.events.readonly): to read your calendar events so Cloop can show your schedule and surface time-bound tasks. Cloop does not create, modify, or delete events or calendars.
8.2 How We Use Google User Data
Google user data is used solely to provide the user-facing features described above. Specifically:
(a) to extract your action items and surface them in your Cloop task list;
(b) to show your schedule and surface time-bound tasks;
(c) to maintain the active OAuth session so you do not have to re-authorise on every request;
(d) where you connect a third-party AI assistant, to make your derived tasks and their supporting context available to it at your direction (see section 7).
8.3 Limited Use
Cloop's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
• We do not use Google user data to develop, improve, or train generalised or non-personalised AI or machine-learning models.
• We do not transfer Google user data to third parties except as strictly necessary to provide or improve user-facing features, comply with law, or as part of a merger, acquisition, or sale of assets with user notice.
• We do not use Google user data to serve advertisements, including retargeted, personalised, or interest-based advertising.
• We do not allow humans to read Google user data unless (i) you have given affirmative consent for specific messages, (ii) it is necessary for security purposes such as investigating abuse, (iii) it is necessary to comply with applicable law, or (iv) the data has been aggregated and de-identified.
8.4 How We Store and Protect Google User Data
• OAuth access and refresh tokens are stored encrypted at rest in our database hosted on Supabase; only Cloop's backend can decrypt and use them.
• Email and calendar content is fetched on demand to generate your tasks and context. We retain the tasks we derive, and short excerpts of the source that serve as the evidence behind them, so you, and any AI assistant you choose to connect, can see why a task exists and act on it in context. We do not retain full message archives.
• All data is transmitted over TLS.
• Access to production systems is restricted to authorised personnel and logged.
8.5 AI Processing
Cloop uses Google's Vertex AI (Gemini) to power its features. When Cloop processes your Google data, for example to extract action items from your inbox or to build the context behind a task, the relevant fetched content is sent to Vertex AI strictly to generate the result you see. This data is not used to train or improve generalised or non-personalised AI or machine-learning models, consistent with the Limited Use requirements above.
8.6 Revoking Access and Deleting Your Data
You can disconnect your Google Account at any time from the Cloop Integrations page. On disconnection, Cloop deletes your OAuth tokens immediately. You can also revoke Cloop's access from your Google Account security settings at myaccount.google.com/permissions.
To request deletion of any residual Google user data associated with your Cloop account, email legal@mycloop.com.
9. International Transfers
Some of our service providers operate outside the United Kingdom. Where personal data is transferred abroad, we ensure equivalent protection by relying on:
(a) UK adequacy decisions; or
(b) approved contractual safeguards such as the International Data Transfer Agreement.
10. Security
We maintain technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration or disclosure.
In the event of a suspected data breach, we will notify affected individuals and the relevant regulator where legally required.
11. Retention
Your Cloop workspace data is your tasks, projects, and the context we surface for you. We keep it for as long as your account is active, so it stays available to you whenever you return.
When you close your account, the personal data associated with it is deleted, other than limited records we are legally required to keep (for example basic transaction records, which statutory rules oblige us to retain for six years).
12. Your Rights
Under UK data protection law you may:
(a) access the personal data we hold about you;
(b) request correction of inaccurate data;
(c) request deletion of your data;
(d) object to processing based on legitimate interest;
(e) request restriction of processing;
(f) request portability of your data;
(g) withdraw consent at any time where consent is the processing basis.
To exercise any of these rights, contact legal@mycloop.com.
13. Third-Party Links
Our website may link to external sites we do not operate. We are not responsible for their privacy practices and recommend reviewing their policies independently.
14. Cookies
Your browser settings allow you to refuse or manage cookies. Disabling cookies may affect the functionality of parts of this website.
15. Complaints
You may lodge a complaint with the Information Commissioner's Office (ico.org.uk) at any time. We would prefer the opportunity to address your concerns directly first. Please contact us before approaching the ICO.
Questions or rights requests
Legal Department
CLOOP LTD
66 Paul Street, London, EC2A 4NA
legal@mycloop.com