Privacy Policy

Effective Date: November 3, 2026

1. Who We Are and How to Contact Us

Loomis is a product of O2mation LLC, a Wyoming (USA) limited liability company (“O2mation”, “we”, “us”). This policy explains what personal data we collect through Loomis and our website, why, and what choices you have. For any privacy question or request, email legal@loomis.bot.

2. Two Kinds of Users, Two Roles

  • Customers: people and organizations who create a Loomis account. For your account, billing and website data, we are the controller (we decide how it is used).
  • End-Users: people who chat with or comment to a Customer’s bot on Facebook, Instagram, Telegram or a website. For this data, the Customer is the controller and we are the processor: we handle it on the Customer’s behalf and under their instructions, as set out in our Data Processing Addendum. If you are an End-User, the business you talked to is your main contact, but you can also contact us (see Section 10 and our Data Deletion page).

3. Information We Collect

From Customers:

  • Account data: name, email address, password (stored only as a secure hash by our authentication provider), organization name, team members and their roles.
  • Connected channels: access tokens for the Facebook Pages, Instagram accounts and Telegram bots you connect (encrypted at rest).
  • Bot content: bot instructions and settings, and the text extracted from knowledge documents you upload. The original PDF file is not kept after its text is extracted.
  • Billing data: plan, credit balance and payment records, and the customer and subscription identifiers from our payment provider. We do not receive or store your full card number.
  • Usage and technical data: message counts, AI model usage, response times, error logs, and IP addresses used for security and rate limiting.

From End-Users (on behalf of Customers):

  • Identifiers: platform IDs from Meta, Telegram chat IDs, and random visitor IDs for the Web Chat Widget.
  • Profile information: first and last name provided by Meta for Facebook and Instagram users.
  • Conversations: chat messages and transcripts, AI-written summaries for human handoff, and timestamps.
  • Voice messages: sent to our AI provider to understand them. We do not store the audio or a transcript; our database only records that a voice message was received.
  • Leads: contact details (such as an email address or phone number) that an End-User types into a chat, which the AI may pick out for the Customer.
  • Comments: if the Customer turns on comment automation, public comment text, commenter IDs, post IDs, and logs of the automated replies and messages sent.

4. Why We Use Information and Our Legal Bases

  • To provide Loomis (run your bots, generate replies, show conversations, process payments): because it is necessary to perform our contract with you.
  • To keep Loomis secure (prevent fraud, abuse, spam and trial misuse, fix errors): based on our legitimate interest in a safe, working service.
  • To communicate with you (account emails, verification, billing and important changes): to perform our contract, and our legitimate interest in keeping you informed.
  • To meet legal duties (tax, accounting, responding to lawful requests): because the law requires it.
  • End-User data: only to provide the Services to the Customer, following the Customer’s instructions.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use Customer or End-User conversations to train AI models.

5. Service Providers (Sub-processors)

We share data only with providers that help us run Loomis:

  • Google LLC: Gemini AI models (receives chat messages, bot instructions, knowledge text and voice audio to generate replies).
  • Supabase Inc.: database, authentication and real-time updates (our database is hosted on Amazon Web Services in Frankfurt, Germany, in the European Union).
  • Stripe Inc.: payment processing.
  • Our server hosting provider: runs the Loomis application servers.

Platforms you connect: when you connect Facebook, Instagram or Telegram, messages are exchanged with Meta Platforms Inc. or Telegram so your bot can work. These platforms are chosen by you and handle data under their own terms and privacy policies; they are not our sub-processors.

We may change providers (for example, switch AI model providers). We will update this list before a new provider receives personal data, and Customers under our Data Processing Addendum can object as described there. We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of our business.

6. Web Chat Widget, Cookies and Local Storage

Our dashboard uses essential cookies to keep you signed in, and your browser’s local storage to remember a few dashboard settings and your bot test chats. The Web Chat Widget opens in a small window served from loomis.bot and uses local storage for that site to remember an End-User’s chat session. We do not use advertising or tracking cookies. See our Cookie & Storage Notice.

7. How Long We Keep Data

  • Account and bot data: while your account is open.
  • Conversations, leads and comment logs: while the Customer’s account is open, unless the Customer or End-User asks us to delete them sooner.
  • After an account is closed: we delete account and End-User data within 30 days, except where we must keep some records longer.
  • Billing and tax records: kept for as long as tax and accounting laws require.
  • Security logs: kept only as long as needed for security.

8. How We Protect Data

We use encryption in transit (HTTPS), encryption of channel access tokens at rest, database rules that keep each Customer’s data separate, and access limits for our team. No system is perfectly secure, but if a breach affects your personal data, we will notify you and the authorities when the law requires.

9. International Transfers

We are a United States company. Our database is stored in the European Union (Frankfurt, Germany), but some of our providers, such as Google and Stripe, may process data in the United States or other countries. Where data from the EU, EEA, UK or Switzerland is transferred, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, or our providers’ certifications under the EU-US Data Privacy Framework where available.

10. Your Rights

Depending on where you live, you may have the right to access, correct, delete or download your personal data, to object to or restrict some uses, and to withdraw consent. California residents have the right to know, delete and correct personal data, and to not be discriminated against for using these rights. We do not sell or share personal data as defined by California law.

To use your rights, email legal@loomis.bot. We may need to confirm your identity. We will answer within 30 days (or sooner where the law requires). If your request is about End-User data, we may pass it to the Customer who controls that data and help them respond. You can also complain to your local data protection authority.

11. Children

Loomis is not made for children. Customers must be at least 13, and those under 18 need a parent’s or guardian’s permission. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, email us and we will delete it.

12. Meta Permissions We Request

When you connect Facebook or Instagram, we request these permissions only to provide the features you turn on:

  • pages_show_list: to list the Facebook Pages you manage.
  • pages_manage_metadata: to subscribe to webhooks for your Pages.
  • pages_messaging: to send and receive messages on Facebook Messenger.
  • instagram_basic: to read basic Instagram account information.
  • instagram_manage_messages: to send and receive messages on Instagram Direct.
  • pages_read_engagement: to read Page posts and comments.
  • instagram_manage_comments: to read and reply to Instagram comments.
  • pages_manage_engagement: to read and reply to Facebook comments.
  • pages_read_user_content: to read public posts and comments on your Facebook Pages for comment automation.
  • business_management: to manage assets and permissions in your Business Manager account.
  • instagram_manage_engagement: to like and reply to Instagram comments for the comment-to-DM feature.

13. Changes to This Policy

We may update this policy. We will change the Effective Date above, and for important changes we will tell Customers by email or in the dashboard before they apply.

14. Contact

O2mation LLC (Loomis). For data deletion, access requests or any privacy question, email legal@loomis.bot.