Protected passwords
We protect your Loop login without storing your original password. The stored password record is used to verify your login.
Security & AI
Clear permissions. Protected access. Your team in control.
See how Loop protects your login, limits access to your business data and keeps your team in control of AI-assisted work.
How we protect access
Protected connections
Connection credentials are encrypted and used by authorized service workflows. Passwords and access tokens are kept out of Loop’s normal AI conversations.
Team access
Your team can access only the venues and tasks their permissions allow. Creating a Loop account does not give access to another business.
Protected sign-in
The mobile app uses your device’s protected storage to keep you signed in. The web workspace uses protected login cookies. Signing in with Google is separate from connecting a Business Profile.
Approval for external changes
Public Google replies and supported POS changes require specific manager approval. Automated guest replies follow the venue’s configured rules, with staff takeover and the connected channel’s messaging limits.
Work you can review
Records of approvals and results help authorized work stay accountable. Central AI monitoring tracks usage and performance without copying full requests and replies into that log.
Technical details
- Loop account passwords use salted, one-way scrypt hashes. The original password is not stored as a recoverable secret.
- Integration credential storage uses AWS SSM Parameter Store SecureString. Authorized server-side workflows retrieve the credentials needed for a task.
- Native session persistence uses Expo SecureStore. HTTPS web sessions use HttpOnly cookies with Secure and SameSite controls.
- Central AI usage monitoring records model, token usage, timing, status and hashed references rather than raw prompts or responses. Conversation and workflow records have separate retention rules.
How Loop uses AI
AI supports the work your team wants to do. Permissions and approval still govern what the service can access or change.
The information a task needs
Loop uses AI services, including OpenAI, to understand requests, draft replies and campaign content, and prepare recommendations. The service may receive relevant conversation context, venue information, selected business records or an asset you provide for the task.
Where information is processed
Information used for an AI task is processed by the selected service under its data policy and settings. How long it is kept depends on the feature you use. Loop’s conversation history and work records have their own retention rules, explained in the Privacy Policy.
OpenAI describes its API data handling in its data controls documentation. See our AI privacy explanation for the context Loop may process.
Different data has different rules
Loop reads Google reviews for your connected location when needed. Review content is kept briefly for the active task or review view and then cleared. It is not saved as a permanent review history or reusable AI memory. Other connections have their own access and data rules, explained on the integration pages.
Your team reviews the work
Your team can review, adjust and approve proposed work. AI output can be incomplete or incorrect. Supported changes in connected apps need the required specific approval. Automated guest replies follow your venue’s agreed rules and the channel’s policies.
Privacy, infrastructure and support
AWS provides cloud services for hosting and protected business connections. Your team uses the Loop app or web workspace. Read more about the AWS foundation and the native app.
For the information we process, service providers, international processing, retention and your choices, read the Privacy Policy. To disconnect or request removal of applicable records, use our Data Deletion instructions.
For a security concern or privacy question, contact hello@loopdup.com.