Privacy Policy

Loomlytics is a monitoring and web analytics service run by Blupp, [Street address], New Delhi, [PIN], India.

For your account data we are the data controller (data fiduciary). For analytics collected on our customers' websites, the customer is the controller and we process that data on their behalf and only on their instructions.

• Account details: name, email address and a hashed password. We never store your password in plain text.
• Workspace details: workspace names, team members you invite, and their roles.
• Site configuration: the domains you add, monitors you set up and webhook destinations.
• Billing details: plan, invoices and billing address. Card and bank details are handled by [Payment gateway name] and never reach our servers.
• Security and usage logs: sign-in activity and errors, kept to protect your account and fix problems.
• Messages you send us by email.

When a site uses the Loomlytics tracker, we collect only what's needed for aggregate traffic reports:

• Page URL, page path and referring site.
• Campaign tags in the URL (utm_source, utm_medium, utm_campaign).
• Browser, operating system and device type, read from the user agent.
• Country and city, looked up from the IP address at the network edge.
• Screen viewport size and time spent on the page.
• Custom events and goals the site owner chooses to send.

The visitor analytics tracker uses no cookies and does not store IP addresses in analytics records. Random session and active-page IDs are held only in the tracker’s memory. They survive SPA route changes and back/forward cache restoration, but reset on a full navigation or reload. Tabs have separate IDs; visits, funnels and journeys can be split across page loads. Active pages estimates visible pages reporting in the last 60 seconds, so reloads can temporarily overlap and it does not measure unique people.

The tracker reads a local-storage preference to honor opt-outs. It writes or removes that preference only when a visitor explicitly opts out or opts in; it does not store tracking IDs in local or session storage. When browser storage is unavailable, an explicit opt-out still applies to the current page, but may not survive a reload.

Loomlytics account sign-in uses authentication cookies, separate from the visitor analytics tracker.

Cookieless analytics does not automatically remove consent requirements. Site owners must assess the requirements that apply to their location and configuration; the tracker supports consent gating and withdrawal.

The tracker respects Do Not Track and Global Privacy Control by default, and skips tracking when a visitor has opted out.

• To provide the service: run monitors, build dashboards and send reports and alerts.
• To manage your account, process payments and send invoices.
• To send service emails such as email verification, password resets and incident alerts.
• To keep the service secure, prevent abuse and filter bot traffic.
• To meet legal, tax and accounting obligations.

We do not sell personal data, show ads, or use visitor data to build profiles across websites.

We share data only with service providers that help us run Loomlytics, under contracts that limit how they can use it:

• Cloudflare: hosting, content delivery and network security.
• Loomup: application backend and database.
• [Payment gateway name]: payment processing.

We may also disclose data when required by law, or to protect our rights, users or the public.

We keep account and analytics data for as long as your workspace is active. When you delete a workspace, its data is removed within 30 days.

We keep invoices and billing records for as long as tax and accounting laws require.

Data is encrypted in transit with TLS. Passwords are hashed, and accounts can be protected with multi-factor authentication. Access to production systems is limited to people who need it to run the service.

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and the EU GDPR, you can:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data, or delete your workspace yourself from the dashboard.
• Export your analytics as CSV.
• Withdraw consent or object to processing.
• Nominate another person to exercise your rights.
• Complain to your data protection authority.

To use any of these rights, email mohit@blupp.co. We reply within 30 days. If you are a visitor to a customer's website, please contact that website's owner first, since they control that data.

Our service providers may process data outside your country. Where that happens, we rely on safeguards such as standard contractual clauses.

Loomlytics is a business service and is not meant for anyone under 18. We do not knowingly collect data from children.

If we make material changes, we'll update the date at the top of this page and email customers before the change takes effect.

For privacy questions, requests or complaints, contact our grievance officer:

• Name: [Grievance officer name]
• Email: mohit@blupp.co
• Phone: [+91 phone number]
• Address: Blupp, [Street address], New Delhi, [PIN], India