Privacy Policy

1.Who we are

The controller responsible for the personal information described in this policy (except where we act as a processor, explained in section 3) is:

"Loopmerce", "we", "us" and "our" refer to Loopmerce LLC. "You" refers to the person whose personal information is processed, whether you are a customer, an authorized user of a customer, or a visitor to our website.

2.Scope

This policy applies to:

• The Loopmerce website at loopmerce.com;
• Loopmerce Customer Rep, including the Chrome extension and its connected Loopmerce services;
• Loopmerce Shipping;
• Loopmerce Invoicing, including invoice.loopmerce.com;
• Other connected Loopmerce application domains as they are configured;
• Our support and sales communications with you.

This policy does not cover third-party services you connect to Loopmerce (such as marketplaces, carriers, Google services or payment providers), which are governed by their own privacy notices.

3.Our roles

Data protection law distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" or "service provider" (who processes data on another party's instructions). Loopmerce acts in both roles, depending on the data.

Loopmerce as controller

We act as a controller for data we decide the purposes of, including:

• Website visitor information (such as server request logs);
• Account and business information;
• Billing and transaction information;
• Product usage and diagnostic information generated within our own systems;
• Support communications;
• Security and audit logs;
• Marketing preferences, where you provide them.

Loopmerce as processor or service provider

When you use our products to handle your marketplace operations, you decide what data enters Loopmerce and why. For that data we act as your processor and service provider, handling it under your instructions and our Data Processing Agreement. This includes:

• Marketplace order data;
• Marketplace customer data;
• Support-ticket content;
• Shipping details and tracking information;
• Invoice and credit-note customer details;
• Device identifiers such as IMEI or serial numbers, where you provide them;
• Other data processed on your instructions.

For this category, you (our customer) normally act as the controller or business, or as a processor acting for another controller. If you are an authorized user of a customer, please also refer to that customer's own privacy notice.

4.Information we collect

We collect the following categories of information, depending on which parts of Loopmerce you use. We do not necessarily collect every item for every user.

Information you or your organisation provide

• Account and identity data (such as name and work email of authorized users);
• Business information (such as company name and marketplace seller identity);
• Contact information;
• Authentication information (such as credentials used to sign in to Loopmerce);
• Billing and transaction information (handled through our payment processor; see section 8);
• Marketplace and carrier credentials that you choose to connect;
• Support communications.

Information processed on your instructions (as processor)

• Marketplace order information;
• Customer-support ticket information;
• Shipping and tracking information;
• Invoice and credit-note information;
• Device identifiers such as IMEI or serial numbers, where relevant;
• Google Sheets information, where you connect that optional logging feature to your own sheet.

Information collected automatically

• Device and browser information;
• IP address;
• Usage and diagnostic information generated when you use the products;
• Security and audit logs;
• A device identifier we generate to manage how many devices are signed in to your organisation's subscription.

On the public website specifically, we do not use advertising cookies, analytics cookies, marketing pixels or client-side tracking storage. See our Cookie Policy for details.

5.How information is collected

• Directly from you when you contact us, create an account or configure a product;
• From connected marketplaces (such as Back Market and Refurbed) when you authorize a connection;
• From connected carriers and carrier aggregators when you use shipping features;
• From connected Google services when you enable optional Google Sheets logging;
• From our payment provider in connection with billing;
• Automatically through standard web-server logging and product operation;
• From your support communications with us.

6.Purposes and EU legal bases

Where the European Union General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the legal bases set out below. Where we act as your processor, the legal basis for that processing is determined by you as controller; the table reflects our own processing as controller unless stated.

We do not rely on consent as the default basis for processing that is necessary to perform our contract with you. Where we rely on legitimate interests, we balance those interests against your rights and you may object as described in section 13.

7.AI-assisted processing

Loopmerce Customer Rep uses AI-assisted processing to prepare summaries, draft replies and recommended actions for your support agents. The following applies:

• Human review remains available. A person on your team reviews and decides what is actually sent to a customer.
• We do not make solely automated decisions that produce legal or similarly significant effects about individuals.
• To provide the feature, relevant ticket or order content may be transmitted to an AI provider that we use as a subprocessor, only when a response is requested.
• The extent to which an AI provider may use content is governed by our contract with that provider. Where our provider contract permits us to do so, we limit the provider's use of your content to providing the feature.

We do not use the content you process through Loopmerce to train our own general-purpose AI models unless we separately agree that with you. We describe the AI provider and any training terms accurately once they are confirmed; we do not publish an unverified claim that content is "never" used for training. You must not submit unlawful content or unnecessary sensitive personal data to AI-assisted features.

8.How information is shared

We share personal information only with the categories of recipients needed to run the service and only where a valid basis applies:

• Hosting and infrastructure providers that run our website and products;
• Payment processing providers for subscriptions and usage billing;
• Authentication and security providers;
• Email delivery providers for transactional and support email;
• AI processing providers, for the Customer Rep feature described in section 7;
• Marketplace APIs (such as Back Market and Refurbed) that you connect;
• Carrier APIs and carrier aggregators that you use for shipping;
• Google services, where you enable optional Google Sheets logging, and the Google Fonts service used to display our website typography (which receives your IP address when your browser loads the font);
• Professional advisers such as auditors and lawyers, under confidentiality;
• Authorities where we are legally required to disclose;
• A successor entity in connection with a merger, acquisition or asset sale, subject to this policy.

Device status checks: When an agent uses the optional iCloud status feature, the device IMEI or serial number is transmitted to a third-party device verification provider that returns the iCloud or Find My lock status for that device. Only the identifier needed for the lookup is sent, and only when the agent chooses to run the check.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We name our confirmed providers in the subprocessor appendix to our Data Processing Agreement rather than listing unverified companies here.

9.Subprocessors and service providers

Where we process personal data on your behalf, we use subprocessors under written contracts that require appropriate protection. The current subprocessors, the purpose they serve and their locations are listed below, and are also maintained in the subprocessor appendix to our Data Processing Agreement, together with the mechanism for notifying you of material new subprocessors.

10.International data transfers

Loopmerce LLC is established in the United States, and some of our providers are located in the United States or other countries. This means personal information may be transferred outside the European Economic Area (EEA), the United Kingdom or Switzerland.

Where we transfer personal data from the EEA, the UK or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with any additional safeguards that are appropriate, and, for the UK and Switzerland, the relevant addenda. We do not claim participation in the EU-US Data Privacy Framework. You can request more information about the safeguards that apply using the contact details in section 18.

11.Data retention

We keep personal information only for as long as it is needed for the purposes described in this policy, and then delete or anonymise it. Retention differs by category:

• Account data is retained while your account is active;
• Billing data is retained for the periods required by accounting and tax law;
• Marketplace operational data (processed on your behalf) is retained according to your instructions and our Data Processing Agreement;
• Support tickets are retained for the duration of the relationship plus a reasonable period;
• Shipping data and invoice and credit-note records are retained as needed to operate the service and to meet record-keeping obligations;
• Security and audit logs are retained for a limited period appropriate to their purpose;
• Backups are retained on a rolling cycle and overwritten in the normal course;
• Cookie preferences are not stored by the website, which uses no cookies of its own.

Where we cannot yet state a fixed period for a category, we apply the principle above and confirm specific periods with you on request.

12.Security

We use appropriate technical and organisational measures to protect personal information. These include encrypting marketplace and carrier credentials at rest using AES-256, encrypting data in transit, account and tenant isolation, access controls on a least-privilege basis, and logging and monitoring. You can read more on our AES-256 Encrypted Credentials page.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We describe our measures accurately and without offering guarantees.

13.Privacy rights in the EEA, UK and Switzerland

If you are in the EEA, the United Kingdom or Switzerland, you have the following rights in relation to personal data for which we are the controller, subject to legal conditions and exceptions:

• The right to be informed about our processing;
• The right of access to your personal data;
• The right to rectification of inaccurate data;
• The right to erasure ("right to be forgotten");
• The right to restrict processing;
• The right to data portability;
• The right to object to processing based on legitimate interests;
• The right to withdraw consent at any time, where we rely on consent;
• The right to lodge a complaint with your supervisory authority.

These rights may be limited by legal exceptions. Where we process data as a processor on a customer's behalf, please direct your request to that customer, and we will assist them as required. To exercise a right, contact us as described in section 18.

14.United States privacy rights

Several U.S. states have comprehensive privacy laws. Whether a specific state law applies to Loopmerce depends on legal thresholds and the circumstances of processing, so the rights below apply where applicable under the law of your state. We do not claim that every U.S. state statute applies to us automatically.

Where applicable, you may have the right to:

• Know or access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete personal information;
• Obtain a portable copy of your personal information;
• Opt out of the "sale" of personal information;
• Opt out of "sharing" for cross-context behavioral advertising, or of targeted advertising;
• Limit the use of certain sensitive personal information;
• Appeal a decision we make on your request;
• Not be discriminated against for exercising your rights.

As explained in section 8, we do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of in those respects. To exercise a right, contact us as described in section 18.

15.California notice

This section provides additional information for California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies. Loopmerce is a business-to-business service and may not meet the CCPA's applicability thresholds; where it applies, the following describes our practices.

• Categories of personal information collected: identifiers (such as name, email and IP address), commercial information (such as account and billing records), internet or network activity (such as product usage and logs), and, where you provide it through our products, customer and order information. We describe these categories in section 4.
• Purposes: as described in section 6.
• Categories of recipients: as described in section 8.
• Sale of personal information: we do not sell personal information.
• Sharing for cross-context behavioral advertising: we do not share personal information for this purpose, and we do not use targeted advertising.
• Sensitive personal information: we do not use sensitive personal information for purposes beyond those permitted by law.

Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" mechanism that performs no function. Where a valid opt-out preference signal such as Global Privacy Control (GPC) is received, we treat it consistently with this no-sale, no-share position. You may exercise the California rights described in section 14 by contacting us as described in section 18, and you may use an authorized agent as permitted by law.

16.Children

Loopmerce provides business tools and is intended for use by businesses and their authorized personnel. The services are not directed to children. We do not knowingly collect personal information from individuals under 16 years of age, and the services are not directed to children under 13. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps.

17.Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. We encourage you to review this policy periodically.

18.Contact and requests

To ask a question about this policy or to make a privacy request, contact:

To protect your information, we may need to verify your identity before acting on a request, and we may ask for information that matches what we already hold. Where the law allows, an authorized agent may submit a request on your behalf with proof of authorization. If we act as a processor for a customer, we will refer your request to that customer and assist them as required.

This document is provided for general information and is not legal advice.