How Your Data Is Managed

1.The difference between controller and processor

A controller decides why and how personal data is used. A processor handles data on someone else's instructions. When you use Loopmerce to run your marketplace operations, you are normally the controller and Loopmerce is your processor. For our own account, billing and security data, Loopmerce is the controller. This distinction runs through everything below and is set out formally in our Data Processing Agreement.

2.Website and account data

The public Loopmerce website uses no advertising cookies, no analytics tracking and no client-side tracking storage. When you visit, our server receives standard request information such as your IP address, and our website loads its typeface from Google Fonts, which receives your IP address to serve the font. When you create a product account, we collect account and business details and authentication information so you can sign in and use the products.

3.Customer Rep data flow

The agent chooses when to request assistance, human review stays in control, and the product does not remove device activation locks. Optional lock-status checking uses available device identifiers such as IMEI or serial numbers.

4.Shipping data flow

5.Invoicing data flow

6.AI-assisted processing

Customer Rep uses AI-assisted processing to prepare summaries, drafts and recommendations. A human on your team reviews and decides. Content is transmitted to a verified AI provider only when a response is requested, and the extent to which the provider may use content is governed by our contract with that provider. We do not use your processed content to train our own general-purpose models unless we separately agree that with you. More detail is in the Privacy Policy.

7.Google Sheets connections

Google Sheets logging is optional. When you connect it, Loopmerce writes the handled case to a sheet in your own Google account. You control that sheet, and you can disconnect the connection at any time. Data you write to your own sheet is then governed by your Google account and your own arrangements.

8.Marketplace connections

You connect marketplaces such as Back Market and Refurbed to bring in the orders and tickets you already manage. Loopmerce is independent from those marketplaces. You are responsible for keeping your marketplace accounts authorized, and their own terms apply to your use of them.

9.Carrier connections

For shipping, you connect carriers such as DHL, UPS, PostNL and DPD, directly or through Sendcloud, using your own accounts and credentials. Those credentials are encrypted at rest using AES-256 (see the AES-256 Encrypted Credentials page). Recipient details are shared with the carrier you select in order to produce a label and tracking.

10.Billing information

Billing is handled through our payment processor. Loopmerce receives the billing and transaction information it needs to manage your subscription or usage charges. Payment card details are handled by the payment processor. Pricing is set out on the product pages and in the Terms and Conditions.

11.Storage and retention

We keep data only as long as needed for the purpose it was collected, then delete or anonymise it. Different categories have different retention: operational data follows your instructions and the DPA, billing and invoice records follow accounting and tax record-keeping periods, logs are kept for a limited period, and backups rotate on a normal cycle. The Privacy Policy explains retention by category.

12.International transfers

Loopmerce LLC is based in the United States, so data may be transferred internationally. For data from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses and appropriate safeguards. We do not claim participation in the EU-US Data Privacy Framework. See the DPA transfer annex.

13.Security controls

We use appropriate technical and organisational measures, including AES-256 encryption of marketplace and carrier credentials at rest, encryption in transit, tenant isolation, least-privilege access, and logging and monitoring. These are described accurately and without guarantees on the AES-256 Encrypted Credentials page and in DPA Annex 2.

14.Deletion and account closure

You can stop using the products and close your account. On closure, we delete or return Customer Personal Data as described in the DPA, subject to records we must keep by law (such as invoices for accounting purposes). Data in routine backups is deleted on the normal backup cycle. To request deletion, contact us as described below.

15.Your choices and rights

Depending on where you are, you may have rights to access, correct, delete, port or object to the processing of your personal data. The Privacy Policy explains EEA/UK rights and U.S. state rights, including how to exercise them and the fact that we do not sell or share personal information for advertising.

16.Subprocessors

Where we use subprocessors to help run the products, we list them in the subprocessor appendix to the DPA, along with the way we notify customers of material new subprocessors. We list a provider only after its use is confirmed.

17.Contact

This page is a plain-language summary. It does not replace the Privacy Policy or the Data Processing Agreement, which govern in case of any difference.