1. Who we are
Loomi ("Loomi", "we", "us", "our") is a customer conversation platform operated by M and N Ecom Management FZ-LLC, a company incorporated in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates, licence number 45000357, with its registered address at Compass Building, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.
This policy explains how we collect, use, share, and protect personal data when you visit loomi.chat, create a Loomi account, or use the Loomi platform, and when your messages are handled by a business that uses Loomi.
Contact for privacy matters: Contact@loomichat.com
2. Two roles: controller and processor
Loomi is used by businesses ("Customers") to manage conversations with their own customers ("End Users") across WhatsApp, Instagram Direct, Facebook Messenger, Telegram, and website live chat.
- When we act as controller. We decide how and why data is processed for our website visitors, account holders, Customer staff who log in ("Users"), billing, sales, and support. This policy governs that data directly.
- When we act as processor. When an End User messages a business that uses Loomi, that business is the controller of the conversation data. We process it only on the business's instructions to provide the service. If you are an End User, the business you contacted is responsible for telling you how it uses your data and for handling your requests. We will support that business in responding to you, and you may also contact us and we will forward your request.
3. Data we collect
a) Website visitors
- Device and usage data: IP address, browser type, pages viewed, referring page, approximate location derived from IP.
- Information you submit in forms: name, work email, phone or WhatsApp number, company name, and your message.
b) Account holders and Users
- Account data: name, work email, phone number, company name, role, password (stored hashed), and login activity.
- Billing data: billing contact, billing address, plan, seat count, invoices, and payment status. Card details are handled by our payment provider; we do not store full card numbers.
- Configuration data: connected channels, workflows, AI agent settings, knowledge base sources, and integration settings.
- Support data: messages and recordings you share with our support team.
c) Conversation data (processed on behalf of Customers)
- End User identifiers provided by the messaging channel: phone number, username, display name, profile picture, and channel-specific IDs.
- Message content: text, voice notes, images, files, and message metadata (timestamps, delivery and read status).
- Data a Customer adds: contact notes, tags, order information, and CRM fields.
- Commerce data when a Customer connects an e-commerce store (for example Shopify): product, stock, and order information needed to answer End User questions.
d) Data from Meta and other platforms When a Customer connects a WhatsApp Business Account, Instagram account, Facebook Page, or Telegram bot, we receive the data those platforms make available through their official APIs, limited to the permissions the Customer grants. We use this data only to provide the Loomi service to that Customer.
4. How we use data
- To provide, operate, and maintain the platform, including routing messages, generating AI replies, transcribing voice notes, and reading images when a Customer has enabled these features.
- To create and manage accounts, authenticate Users, and provide support.
- To bill Customers, track seats and AI credit usage, and prevent fraud and abuse.
- To secure the service, debug errors, and monitor performance.
- To communicate with Users about the service, including service notices and, where permitted, product updates (you can opt out of marketing at any time).
- To comply with legal obligations and enforce our Terms.
We do not sell personal data. We do not use conversation data to train AI models.
5. AI features
Loomi uses third-party large language models to generate draft or automatic replies, summarise conversations, transcribe voice notes, and interpret images. Message content is sent to these providers only to generate the requested output. AI output can be inaccurate. Customers control whether AI replies are sent automatically or reviewed by a human, and are responsible for the replies sent from their accounts.
6. Legal bases
Where laws such as the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law, Lebanese Law No. 81 of 2018, or the EU/UK GDPR apply, we rely on: performance of a contract (providing the service), legitimate interests (security, improvement, business communication), consent (where required, for example certain marketing), and legal obligation (tax, accounting, lawful requests).
7. Sharing and sub-processors
We share personal data only with:
- Service providers (sub-processors) that help us run Loomi, bound by contracts requiring confidentiality and security:
- Cloud hosting and database: Supabase
- AI model providers: Anthropic
- Speech-to-text: Anthropic
- Image processing: Google
- Website crawling for knowledge bases: Firecrawl
- Payments: Stripe
- CRM and customer communication: HubSpot
- Email delivery: Resend
- Messaging platforms (Meta for WhatsApp, Instagram, and Messenger; Telegram) as required to send and receive messages.
- Integrations a Customer chooses to connect (for example Shopify).
- Partners who referred or onboard a Customer, limited to account-level information needed to administer the partnership (company name, plan, and account status — never conversation content).
- Authorities where required by law or to protect rights, safety, and security.
- A successor in a merger, acquisition, or asset sale, subject to this policy.
An up-to-date sub-processor list is available on request at Contact@loomichat.com.
8. International transfers
Our team operates from the United Arab Emirates and Lebanon, and our providers may process data in other countries, including [HOSTING REGIONS]. Where data leaves its country of origin, we rely on appropriate safeguards such as contractual protections and the transfer mechanisms permitted by applicable law.
9. Retention
- Account and configuration data: for the life of the account, then deleted within 30 days of account closure.
- Conversation data: kept while the Customer's account is active, subject to any retention period the Customer sets, and deleted within 30 days of account closure or of a valid deletion request.
- Backups: deleted data is purged from backups within 90 days.
- Billing records: kept for as long as tax and accounting laws require (typically 5 years).
- Website form submissions: up to 24 months after our last interaction, unless you become a Customer.
10. Security
We use encryption in transit (TLS), encryption at rest, access controls, least-privilege permissions for staff, and audit logging. Access tokens for connected channels are stored encrypted. No system is completely secure; if we become aware of a breach affecting your data, we will notify affected Customers and authorities as the law requires.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email Contact@loomichat.com. We will respond within 30 days. If your data is conversation data held on behalf of a business, we will direct your request to that business and help it respond.
To delete data connected through Facebook, Instagram, or WhatsApp, see our Data deletion page at loomi.chat/data-deletion.
You may also complain to your local data protection authority.
12. Cookies
Our website uses strictly necessary cookies to keep you logged in and secure the service.
13. Children
Loomi is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children for our own purposes.
14. Changes
We may update this policy. We will post the new version here with a new "Last updated" date, and notify account holders by email or in-app of material changes.
15. Contact
M and N Ecom Management FZ-LLC (Loomi) Compass Building, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates Contact@loomichat.com