Privacy Policy

This Policy covers personal information we process as a business about account users, website visitors, billing contacts, and similar individuals.

When our customers use Looniq to collect or manage information about their own end users or status-page subscribers (for example subscriber email addresses, mobile phone numbers, and language preferences), the customer generally determines the purposes of that processing. In that case, the customer is the controller (or “organization” / equivalent), and Looniq acts as a processor / service provider on the customer’s instructions. Customers are responsible for their own privacy notices to those individuals.

This Policy does not apply to third-party websites or services that link to or integrate with Looniq.

Depending on how you use the Service, we may collect:

• Account and profile information: name, email address, authentication identifiers, organization/workspace membership, and similar account data (via our auth provider)
• Workspace and configuration data: status pages, services, incidents, maintenance windows, branding assets, locales, access settings, and related content you submit
• Subscriber and notification data that customers collect through the Service (for example email addresses, mobile phone numbers, preferred language, and channel preferences), processed on the customer’s behalf
• Mobile phone numbers and related messaging opt-in data when someone subscribes to SMS or other messaging alerts (today primarily via status-page web forms; other consented methods may be added later)
• Billing and transaction information: plan selection, subscription status, invoices, and payment method details handled by our payment processor (we do not store full card numbers on our servers)
• Technical and usage data: IP address, device/browser type, approximate location derived from IP, log data, performance metrics, feature usage, and diagnostic information
• Communications: messages you send to us (for example support emails)
• Cookies and similar technologies: essential session and security cookies, and similar storage needed to run the Service; we may also use first-party product analytics for internal product improvement (see Section 9)

We do not intentionally collect sensitive categories of personal information (such as health data or government ID numbers) as part of the core Service. Please do not submit that information unless we have expressly agreed otherwise in writing.

We use personal information to:

• Provide, operate, secure, and maintain the Service
• Create and manage accounts, workspaces, and access controls
• Send transactional messages (for example security alerts, billing notices, and product emails you request)
• Deliver customer-configured notifications (such as status subscriber emails, SMS, and other messaging alerts) on behalf of customers
• Process payments, prevent fraud, and manage subscriptions
• Provide optional AI-assisted features you choose to use (see Section 7)
• Monitor performance, debug issues, and understand how the Service is used so we can improve it
• Comply with law, enforce our Terms, and protect the Service, users, and the public
• Communicate about the Service; where required, we will obtain consent for non-essential marketing emails and honour unsubscribe requests

Where GDPR or similar laws apply, we rely on one or more of: performance of a contract; legitimate interests (such as securing and improving the Service, in a way that does not override your rights); consent where required; and legal obligation.

Where PIPEDA, Québec Law 25, or similar Canadian rules apply, we collect, use, and disclose personal information for the purposes described in this Policy, with consent where required, or as otherwise permitted by law (including purposes a reasonable person would consider appropriate in the circumstances).

Where U.S. state privacy laws apply, we process personal information for the business purposes described above. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising.

We share personal information only as needed to run the Service and as described here:

• Service providers / subprocessors: for example authentication, cloud hosting, databases, email delivery, SMS and other messaging delivery (e.g. Twilio), payment processing, error monitoring, and AI providers that power optional features
• Customer instructions: content and subscriber messages you configure may be visible to status-page visitors or delivered to email/SMS/messaging recipients according to your settings
• Legal and safety: if we believe disclosure is required by law, or necessary to protect rights, safety, or security
• Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction under appropriate protections
• With your direction: when you ask us to, or when you use integrations that send data elsewhere

We do not sell personal information. We do not share it with third parties for their own advertising. In particular, no mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

A current high-level list of major provider categories includes authentication (e.g. Clerk), payments (e.g. Stripe), email delivery (e.g. SendGrid), SMS and messaging delivery (e.g. Twilio), hosting/infrastructure (e.g. Vercel and related cloud infrastructure), and AI model providers for optional features. The specific vendors may change as we grow; we require appropriate contractual protections from providers that process personal information for us.

Looniq may send recurring automated SMS and other messaging alerts related to status pages, incidents, maintenance, and similar service notifications. Today, SMS is primarily available to status-page subscribers who opt in through a web form on a status page. We may later also offer messaging for Looniq account or workspace notifications, and additional consented enrollment methods.

Message frequency varies. Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We may share mobile numbers with messaging service providers (such as Twilio) solely to deliver the messages you or our customers request, to maintain delivery infrastructure, and to comply with law.

You can cancel SMS alerts at any time by replying STOP. For help, reply HELP or contact [email protected]. After you opt out, we will stop sending further SMS to that number for that program, except for a single confirmation of the opt-out where required.

When SMS subscriber data is collected for a customer’s status page, that customer is generally the controller and Looniq acts as processor / service provider. Customers are responsible for presenting required disclosures at opt-in and for honouring applicable rights requests from their subscribers.

If you use AI-assisted features (such as translation or other assistance we may add later), the content you submit for that feature may be sent to one or more third-party AI providers to generate a result.

We use those providers as subprocessors for that limited purpose. Provider practices (including whether inputs may be used to improve models) depend on the provider and the account/API terms available to us, and may change over time. Do not submit information to AI features that you are not allowed to share with subprocessors.

You remain responsible for reviewing AI outputs before publishing them.

We are based in Québec, Canada. Personal information may be processed in Canada, the United States, and other countries where we or our providers operate. Those countries may have different data-protection rules than your home country.

Where required, we use appropriate transfer mechanisms (such as contractual clauses) and take reasonable steps so that providers protect personal information consistent with this Policy and applicable law.

We use cookies and similar technologies that are necessary for authentication, security, preferences, and core functionality.

We may also collect first-party product and performance metrics (for example feature usage and error diagnostics) to operate and improve the Service. We use this information for our own internal analytics—not to sell data or to run third-party advertising.

Our marketing site is largely static. Public status pages and the admin app may set cookies needed for access control (such as private-page sessions) and product operation. You can control cookies through your browser settings; disabling essential cookies may break parts of the Service.

We keep personal information only as long as needed for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

• Account and workspace data: generally for the life of the account/workspace, then deleted or anonymized within about 30 days after a verified deletion request or account closure, except where we must retain a longer copy (for example invoices, fraud prevention, or legal holds)
• Backups: may persist for a limited additional period in encrypted backups before rotation
• Incomplete signups: workspaces that never complete required checkout may be deleted automatically after a short period (currently about seven days)
• Subscriber lists and Customer Content: retained according to the customer’s workspace until the customer deletes them or the workspace is deleted, subject to the backup practices above

We use reasonable technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS), access controls, and reliance on reputable infrastructure providers. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of a breach that requires notification under applicable law, we will notify affected customers and/or individuals and regulators as required.

Depending on where you live, you may have rights to access, correct, update, delete, or export personal information; to withdraw consent; to object to or restrict certain processing; to appeal a decision; or to opt out of certain uses. Québec residents may also have rights related to de-indexing and data portability as provided by Law 25. California and other U.S. state residents may have additional rights to know, delete, correct, and opt out of sale/sharing (we do not sell or share for cross-context ads).

To exercise rights regarding information we control as a business (for example your Looniq account), email [email protected]. We may need to verify your request. We will respond within the time required by applicable law.

If you are an end user or status-page subscriber of a Looniq customer, please contact that customer first. We will assist our customers with verified requests as required for our role as processor / service provider.

You may also lodge a complaint with your local data-protection authority (for example the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or an EU/UK supervisory authority).

The Service is not directed to children under 16 (or the age required by local law), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact [email protected] and we will take appropriate steps to delete it.

We do not use personal information for automated decision-making that produces legal or similarly significant effects about individuals without human involvement.

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and revise the effective date. If changes are material, we will provide additional notice where practicable.

Privacy requests and questions: [email protected]

Looniq

10636 Chem. de la Côte-de-Liesse, Lachine, QC H8T 1A5, Canada