Privacy Policy

Who we are

LOOP is a sensory-friendly business discovery platform operated from Ireland. Our website is loopguide.ie. For any privacy questions, or to exercise your GDPR rights, contact us at hello@loopguide.ie.

Browsing without an account

You can browse every place on LOOP without signing in. While browsing, we do not collect personal data and we do not set tracking cookies. The only thing stored on your device is your plain-mode preference (colour or greyscale display), saved in your browser using localStorage. It never leaves your device.

Visitor accounts

If you create a LOOP account, we collect the minimum needed to run the service.

What we collect. Your email address, an optional display name, and any preferences you choose to share during onboarding (the features you are looking for or would rather avoid, plus an optional general area). You can skip the preferences step entirely.

Your preference profile is Special Category Data. Your saved preferences and any persona label you select can reveal health-related information and are treated as Article 9 GDPR data. We process them on the basis of your explicit consent, given when you finish the onboarding step. They are encrypted at the column level using pgcrypto with a key held in Supabase Vault (separate from the database itself). You can delete your preferences at any time from your profile page.

Reviews and favourites. Reviews you submit are tied to your display name and shown publicly once approved. You can soft-delete your own review at any time; the row stays in our audit log but is hidden from every public surface. Favourites are private to you.

No marketing. We do not send marketing emails and we do not share your contact details with third parties for their own marketing.

Business accounts

Businesses that manage a listing on LOOP provide a small amount of additional information so we can keep the listing accurate and handle billing. This data is held separately from visitor accounts.

What we collect. Owner name, business email, business name, and an optional phone number. Where you upload business photos, we store the file and an alt-text description.

Billing. Payments are processed by Stripe. Stripe collects your card details and billing address directly through their hosted Checkout and holds them on its own systems; we only store your Stripe customer identifier, subscription status, and renewal dates so we can show you the right billing page and keep your listing active.

Who can access it. The LOOP admin team (currently two people) plus Stripe as our payment processor. We do not share business contact details with other businesses or marketing partners.

Retention. Business contact data, your listing, its photos and its reviews are kept while your membership runs. If you cancel, they are deleted 30 days after your paid year ends. If you pause, we keep them for one year after it ends so you can come back, then delete them. We email you a week before either deletion. Billing records (invoice metadata, subscription history) are kept for six years to meet Irish Revenue accounting requirements. If you soft-delete your account, the Stripe customer record (which holds your billing email and address) is removed automatically 30 days later. For removal sooner than that, email hello@loopguide.ie and we will action it manually.

Cookies and similar technologies

LOOP does not use cookies for tracking, advertising, or analytics. We set two strictly necessary cookies only after you sign in:

• sb-access-token and sb-refresh-token: short-lived authentication tokens issued by Supabase Auth so we know who you are between page loads. They are HttpOnly, scoped to our domain, and expire when you log out.

Your plain-mode preference is stored in localStorage (not a cookie) and never leaves your browser.

IP address logging

We record the IP address of each signup, OAuth callback, and preferences-onboarding submission alongside the consent you gave. This is proportionate evidence of consent under GDPR Article 7. IP addresses on these records are automatically anonymised to 0.0.0.0 after three years, which comfortably exceeds the window in which a subject access request for consent records is likely.

Third-party services

We use the following services to run LOOP:

Supabase (database, authentication, storage)

Hosted in Dublin, EU (eu-west-1). SOC 2 Type II certified. Data Processing Agreement in place. Stores your account, preference profile (encrypted), reviews, favourites, consent records, and uploaded business images.

Google (optional sign-in)

If you choose “Continue with Google”, Google receives the fact that you authenticated and returns your email address and Google account ID to us. We do not receive or store any other Google data. See the Google Privacy Policy.

Mapbox (maps on Discover and business pages)

Mapbox renders the interactive map on /discover and the static map preview on each business page. The map is core functionality, so we load Mapbox without a consent prompt under the strictly necessary ground. Mapbox may collect anonymous usage telemetry in the process. See the Mapbox Privacy Policy.

Stripe (payments, business accounts only)

Processes subscription payments for business accounts. See the Stripe Privacy Policy.

Upstash (rate-limit store)

A small in-memory counter keyed on IP, used to throttle abuse of sign-in, signup, password reset, review submission, and image upload. No personal data is stored beyond the IP + short-lived counter.

Vercel (hosting) and Cloudflare (DNS)

Vercel runs the application; Cloudflare resolves our DNS. No personal data is stored by either on our behalf beyond standard request logs.

Your rights

Under GDPR, you have the right to:

• Access any personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data. You can soft-delete your own account from the profile page; the row is hard-deleted 30 days later by an automated overnight job, after which all your reviews, favourites, preference profile, consent records, and (for business owners) Stripe customer record are removed
• Withdraw consent at any time
• Object to processing or request data portability for the data you supplied
• Lodge a complaint with the Irish Data Protection Commission

To exercise any of these rights, email hello@loopguide.ie.

Data storage and security

All data is stored in the EU (Dublin, Ireland) on Supabase infrastructure. Data is encrypted at rest (AES-256) and in transit (TLS). Sensory preferences are additionally encrypted at the column level using pgcrypto with a key held in Supabase Vault. Server-side row-level security policies enforce that you can only see and modify your own data.

Changes

This policy will be updated as features change. We will note the date of the last update at the top of this page.