xLoop AI is operated by SFL Advertising Agency, based in Florida, USA. This Privacy Policy describes how we collect, use, and protect your personal information when you use our website and service. We comply with applicable privacy laws including the General Data Protection Regulation (GDPR) where applicable.
Contact data: lead names, emails, phone numbers, notes, communication history, and custom fields uploaded or synced into the CRM
Gmail integration: email messages and metadata via Google OAuth, used only to display conversation threads inside your account
Follow Up Boss sync: contact and pipeline data via API, used only on behalf of the connected agent
SMS opt-in numbers: mobile phone numbers for outbound and inbound messaging
Usage data: page views, feature interactions, timestamps, and performance metrics
Voice transcripts: audio recordings and transcriptions when using the Zara voice assistant
How we use your information
•Provide and improve the xLoop AI service
•Send SMS notifications and outreach messages with your consent
•Generate AI insights and daily briefings
•Process billing and subscription management
•Provide customer support and technical troubleshooting
•Detect and prevent fraud, abuse, and security issues
•Comply with legal obligations
Third-party data processors
We use the following third-party services to process data on our behalf. Each processor is bound by data-processing agreements and industry-standard security practices. We do not sell your data to any third party.
Supabase: Database hosting (USA and EU regions)
Stripe: Payment processing and billing
Twilio: SMS message delivery and inbound routing
Resend: Email delivery for notifications and password resets
Google: Gmail OAuth for email sync (acts only on your behalf)
Deepgram: Voice-to-text transcription for voice notes
ElevenLabs: Text-to-speech for voice briefings
OpenAI: AI embeddings and natural language processing
Anthropic: Claude AI reasoning for advanced insights
Data retention
Account data is retained while your account is active. Upon cancellation or deletion request, we delete your personal information within 30 days. Database backups and cached data are purged within 90 days. Contact data you have imported remains your responsibility; we can assist with secure export or deletion upon request.
Security
We implement industry-standard security practices to protect your data:
•Encryption in transit (TLS 1.2+)
•Encryption at rest for sensitive fields
•Row-level security (RLS) policies on all data tables
•Scoped OAuth tokens with minimal permissions
•Regular security audits and penetration testing
Your privacy rights
You have the right to:
•Access: request a copy of all personal data we hold
•Correction: update inaccurate or incomplete information
•Deletion: request removal of your personal data
•Export: receive your data in a portable format
•Opt-out: withdraw consent for SMS or email notifications
To exercise any of these rights, email hello@xloopai.com. We will respond within 30 days. PIPEDA and GDPR rights are honored where applicable.
Children
xLoop AI is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete the information and notify the account holder.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or a prominent notice on the website. Your continued use of xLoop AI after changes indicates acceptance of the updated policy.
