Privacy Policy

Our privacy commitment: we collect and store only the data needed to run Loon. We do not sell, share, or monetise your personal information.

Data we collect

Account information

• Email address – for account creation, sign-in, and essential messages
• Account credentials – securely hashed passwords and optional two-factor tokens
• Profile information – name, organisation details, and preferences you choose to give

Workspace data

• Business content – documents, records, and data you create in your workspaces
• Workspace settings – configuration, user permissions, and organisation structure
• Collaboration data – comments and shared content within workspaces

Technical information

• Session data – sign-in status, kept in secure first-party cookies
• Usage logs – access patterns, feature usage, and performance metrics
• Security information – IP addresses, for fraud prevention and access control

How we use your data

• To provide the Loon service and multi-workspace access
• To keep your data intact and backed up
• To authenticate access and prevent unauthorised use
• To provide technical support

Data security

• Encryption – all data is sent over TLS/SSL
• Database security – separate databases with access controls
• Audit trail – a record of who created, changed, or deleted data
• Soft deletion – deleted data is marked as deleted before it is removed

Third-party services

We share the minimum data needed with these providers:

• DigitalOcean – application hosting; technical data needed to run the servers
• Cloudflare – domain management and CDN; request data for speed and security
• Email service – transactional email; your email address, for account messages only

Your rights

• Access – ask for a copy of your personal and workspace data
• Portability – export your data in standard formats
• Correction – update or correct your personal information
• Deletion – ask us to remove your account and its data

Data retention

• Active accounts – kept while your account is active
• Deleted accounts – personal data removed within 30 days
• Workspace data – kept according to your workspace settings and legal requirements
• Audit logs – security and access logs kept for 12 months

Workspace data isolation

• Each workspace is a separate, isolated environment
• Access is limited by workspace membership and permissions
• Sharing data between workspaces needs your explicit consent
• Database-level separation prevents access between organisations

Cookies

• Session cookies – first-party cookies that keep you signed in
• Preference cookies – remember your settings and workspace choices
• No tracking – no analytics or third-party tracking cookies

Changes to this policy

We may update this policy when our practices or legal requirements change. We will tell you about significant changes by email or in the app.

Contact

Questions about this policy or your data? Email [email protected]. We reply within 48 hours.

Driigo Ltd, Gladstonos 43-47, 3041, Limassol, Cyprus