This policy explains what personal information Lazyloop collects, how we use and share it, how long we keep it and the choices you have. It covers the Lazyloop web app at app.lazyloop.ai, our connection service at connect.lazyloop.ai, this website at lazyloop.ai and the emails we send. “Lazyloop”, “we” and “us” mean the company named under Company details on this page.
Who this policy covers
- Customers and their team members: people at brands who sign in to Lazyloop to manage conversations with creators.
- Creators and other contacts: people who exchange messages with a customer through an account the customer connected to Lazyloop.
- Visitors: people who read this website, and people who join the waitlist on it.
Our customers decide which accounts to connect and which conversations to keep. For the messages and contact details in a customer’s workspace, we act as the customer’s service provider and processor: we handle that information on the customer’s behalf and under their instructions. If you’re a creator and have a question about your information, you can contact the brand you talked to, or us (see “Your choices and rights”).
Information we collect
Account information. Your name, work email address, profile picture (if you sign in with Google), the time zone you choose and how you sign in (Google or a code we email you). If you sign in with Google, we receive your name, email address, whether Google has verified it, your profile picture, your Google account ID and, for Google Workspace accounts, your organization’s domain. We never receive your Google password. The members of each workspace you belong to can see your name, email address and profile picture.
Workspace information. The workspaces you create or join, your role in each, the invitations you send or receive and the settings you choose.
Connected accounts and conversations. When a customer connects an Instagram or TikTok account, we receive the messages, attachments and profile details (such as names, handles and profile pictures) of the conversations in that account. When a team member connects a Gmail inbox, we first fetch the last 90 days of email exchanged with the creators the workspace already knows. After that, we read only the headers and labels of new email (such as the sender, recipients, subject and Gmail labels) to find email that relates to creators, and we download the full message, with its attachments, only for that email and for email you give the Gmail label “Lazyloop”, since you chose to bring it in. For other email from a business sender we don’t know yet, we keep only the sender and subject, so the team can review it. We never download the content of any other email. We also store the messages the customer’s team sends through Lazyloop, and the notes, assignments and other information a team adds.
Instagram and TikTok sign-in. To connect an Instagram or TikTok account, you sign in through our connection service at connect.lazyloop.ai. Your password goes straight from your browser to that service, is used only to sign in, and is never stored or logged. The service keeps the resulting session encrypted so that it can send and receive messages for you.
Device and usage information. When you sign in, we record with the session the IP address you signed in from, your browser’s user agent (which names the browser and operating system) and when the session was last used. A session keeps them while it lasts (until you sign out, after 7 days without use, or 30 days at most), and we delete it 30 days after it ends. For each browser you sign in from, we also keep a recognized device record with only a summary of the browser and operating system, an approximate location derived from your IP address (the country), when it was first seen and when it was last used, so you can review your devices and sign out of them. Sign-ins and other account events are recorded in your account’s audit log, and important actions in a workspace, such as role changes and support access, in that workspace’s audit log; both audit logs keep the IP address each action came from, for 1 year. We also keep logs of requests and errors to run and secure the service.
Messages to us. If you email us, we keep your message and our reply.
Waitlist. If you join the waitlist on this website, we collect your work email address and, if you give it, your company name. We use them only to decide when to invite your team and to email you about early access, and we never sell them. We don’t store your IP address or anything else about your visit with them, and we don’t send an email when you join. We keep them for up to 12 months after you join, and delete them sooner when you create your workspace during early access or ask us to delete them. Exports of the list are set to expire within 7 days of being created and are then deleted automatically.
Apart from the waitlist form, this website collects only what our servers record when they deliver its pages and receive the form: your IP address, the page requested, the time, your country, and your browser’s user agent and the other headers it sends, except cookies, sign-in headers, the referring page and forwarded addresses. Our firewall logs keep these for about 13 months, and our content delivery network’s access logs keep the IP address, user agent, page and time for 90 days. Neither is stored with a waitlist entry.
How we use information
We use personal information to:
- provide Lazyloop: show conversations, send the messages you write, sign you in, and send sign-in codes, invitations and security notices;
- keep Lazyloop secure: detect and stop abuse, investigate incidents and enforce our Terms of Service;
- fix problems and make the service more reliable;
- tell you about your account and changes to the service;
- decide when to invite the people on our waitlist, and email them about early access;
- meet our legal obligations.
We don’t sell personal information, we don’t use it for advertising, and we don’t use customer content to train artificial intelligence or machine learning models.
Information from Google APIs
Lazyloop’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
For information we receive from Gmail in particular:
- We use it only to provide and improve user-facing features of Lazyloop, such as showing email conversations with creators in the workspaces the inbox is connected to, and replying to them.
- We transfer it to others only as needed to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to the user.
- We don’t use it to serve advertising, including retargeting and personalized or interest-based ads.
- We don’t sell it, and we don’t use it to develop, improve or train generalized artificial intelligence or machine learning models.
- People at Lazyloop read it only with the user’s affirmative agreement for specific messages, when it’s necessary for security purposes such as investigating abuse, to comply with applicable law, or when it has been aggregated and anonymized for internal operations.
Email with creators from a connected inbox is visible to all members of each workspace the inbox is connected to. Support access to a workspace (described below) includes no Gmail content unless the person who connected that inbox agrees to it separately.
Support access
A workspace owner can let the Lazyloop support team view their workspace for a limited time (72 hours unless the owner picks another length). Support access is read-only, ends on its own, can be turned off at any time, and every visit is recorded in the workspace’s audit log. In an emergency, such as an outage or a security incident, our engineers can reach systems without that permission under strict controls. When that touches a customer’s data, we tell the customer afterward.
How we share information
We share personal information only:
- with service providers (subprocessors) who process it for us under contracts that limit how they may use it, listed below;
- within a workspace: members of a workspace see its conversations, including email with creators from the inboxes connected to it, and its member list, with each member’s name, email address and profile picture; an invitation shows the inviter’s name (or email address, if no name is set) and the workspace’s name;
- with connected platforms: when you send a message through a connected Instagram, TikTok or Gmail account, we send it to that platform;
- for legal reasons: when the law requires it, or to protect the rights, safety and security of our users, the public or Lazyloop;
- in a business transfer: if Lazyloop is part of a merger, acquisition or sale of assets, under this policy.
Subprocessors
| Subprocessor | What they do for us | Location |
|---|---|---|
| Amazon Web Services | Hosting, content delivery, databases, file storage, encryption keys and sending email (Amazon SES) | United States (content delivery edges in North America, Europe and Israel) |
| Sign-in with Google, the Gmail API for inboxes you connect, and our team’s email and documents | United States | |
| Sentry | Error reports from our servers, without message content | United States |
| Grafana Labs (Grafana Cloud) | Service metrics and alert paging for our team, which can include an IP address from a security finding, without message content | United States |
| Slack | Alert messages for our team, through AWS Chatbot, which can include an IP address from a security finding but never message content | United States |
We’ll update this list before we add a subprocessor, including any provider of artificial intelligence features, and we won’t share Google user data with such a provider except as the Limited Use requirements allow.
How long we keep information
| Information | How long we keep it |
|---|---|
| Account information | Until you ask us to delete the account |
| Workspace information | Until the workspace is deleted |
| Conversations, messages and attachments | As long as the workspace exists |
| Instagram and TikTok sessions and Gmail access tokens | Until the connected account is disconnected or its workspace is deleted |
| Raw events received from connected platforms | 30 days |
| Events waiting to be delivered between our services | 7 days after delivery, or after delivery is given up |
| Keys that stop a message from being sent twice | 7 days |
| Signed-in sessions | 30 days after they expire or are signed out |
| Emailed sign-in codes | 1 day after they expire |
| Instagram and TikTok sign-in attempts in our connection service | 24 hours after they expire |
| Recognized devices | 400 days after last use |
| Workspace export files | 24 hours |
| Waitlist entries | Up to 12 months after you join |
| Application logs | 30 days |
| Error reports | 90 days |
| Access logs of our content delivery network and load balancers | 90 days |
| Audit logs | 1 year |
| Security logs of our cloud infrastructure (account activity, network traffic and firewall records) | About 13 months |
| Database backups | 14 days of point-in-time recovery, and daily copies kept for 35 days |
| Deleted files in storage | Recoverable for 30 days, then removed |
When a workspace owner asks us to delete a workspace, we delete its data after a 30-day grace period, including its files and connected-account sessions, and we ask Google to revoke its Gmail access unless another workspace still uses the inbox. When a customer disconnects an account, we stop collecting from it at once; its conversations stay in the workspace unless the customer asks us to delete the data that came from that account. When a customer disconnects a Gmail inbox, we stop collecting from it at once and ask Google to revoke our access, unless the same person has the same inbox connected in another workspace, whose access continues until it is disconnected there too. We retry failed revocation requests; if revocation cannot be confirmed, you can remove Lazyloop from your Google account connections when no other workspace still needs that access. When a creator asks to be deleted, we delete their profile, messages and attachments, and keep only a record that the deletion happened. Audit log entries about an account or a workspace are kept for the audit log period above, even after the account or workspace is deleted.
Backups. Our databases can be restored to any point in the last 14 days, and we keep a daily copy of each for 35 days. The copies are encrypted and locked, so no one can alter or remove them during that time. Deleted data can remain in our backups until they expire, up to 35 days after it is deleted. We restore from a backup only to recover from an incident.
How we protect information
- Data is encrypted in transit over the internet and at rest. Platform sessions and Gmail access tokens get an extra layer of encryption with keys held in a key management service.
- Each workspace’s data is kept apart by database rules that are tested automatically, and access is checked on every request.
- Signing in uses Google or a code we email you, so there are no Lazyloop passwords to steal. Important actions ask you to confirm it’s you, and we email you when a new device signs in.
- Our team’s access to production systems is limited, needs security keys or passkeys and is logged.
No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the affected customers as the law requires.
Cookies
The web app and our connection service use only the cookies they need to work:
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-ll_session |
Keeps you signed in | Until you sign out, after 7 days without use, or 30 days at most |
__Host-ll_device |
Recognizes this browser, so we can warn you about sign-ins from new devices | 1 year |
__Host-ll_oidc |
Protects a Google sign-in while it’s in progress | 10 minutes |
__Host-lzs-instagram |
Set by our connection service at connect.lazyloop.ai to tie a verification step to your browser while you connect an Instagram account | Until the step expires, 10 minutes at most |
__Host-lzs-tiktok |
Set by our connection service at connect.lazyloop.ai to tie a verification step to your browser while you connect a TikTok account | Until the step expires, 10 minutes at most |
We use no analytics, advertising or tracking cookies, and this website sets no cookies at all.
Your choices and rights
- Your account. In Settings you can change your name and time zone, see the devices you’re signed in on and sign out of any of them.
- Workspace data. A workspace’s owner and admins control its members and conversations. A workspace owner can ask us to export or delete the workspace’s data.
- The waitlist. To leave the waitlist, email the privacy contact listed under Company details, and we’ll delete your entry.
California residents. Under the California Consumer Privacy Act (CCPA), you have the right to:
- know what personal information we collect, use and disclose, and get a copy of it;
- delete your personal information;
- correct inaccurate personal information;
- opt out of the sale or sharing of your personal information;
- limit the use of your sensitive personal information;
- not be discriminated against for using these rights.
We do not sell or share your personal information, as the CCPA defines those terms, and we use sensitive personal information only for purposes the CCPA allows, such as providing the service you asked for and keeping it secure. Because we don’t sell or share personal information, a Global Privacy Control signal changes nothing today; if that ever changes, we will update this policy first and treat the signal as a request to opt out.
To use these rights, email the privacy contact listed under Company details. We’ll confirm that we received your request within 10 business days and respond within 45 days. We verify a request by confirming that you control the email address on the account. An authorized agent can make a request for you with your signed permission. When we hold the information on behalf of a customer, we’ll send your request to that customer and help them respond.
We collect these categories of personal information: identifiers (such as name, email address, account IDs and IP address); account log-in credentials (the Instagram and TikTok passwords that pass through our connection service only to sign in, and the platform sessions we keep encrypted), which are sensitive personal information; professional information (such as workspace, role and the company name you give the waitlist); internet activity (the device and usage information described above); approximate location (the country); records that customers keep about creator deals; and the contents of messages and emails in connected accounts, which can include sensitive personal information. Until the Lazyloop app opens to customers, we collect only waitlist email addresses and company names, the IP addresses and browser details in our logs, the email people send us, and the account and device information described above for anyone who signs in to the app. We collect personal information from you, from customers, from connected platforms and from Google sign-in, for the purposes in “How we use information”, and disclose it for business purposes to the subprocessors listed above.
Children
Lazyloop is for businesses and is not directed to children. We don’t knowingly collect personal information from children under 13, and we delete it if we learn that we have.
Where information is stored
We store your information in the United States, where our servers run (Amazon Web Services, US East). Our content delivery network accepts each connection at a location near you, which can be in North America, Europe or Israel, and passes it to our servers in the United States. It caches only the files of this website and the app, never your information, and its access and firewall logs are stored in the United States. If you use Lazyloop from outside the United States, your information is transferred to and processed in the United States.
Changes to this policy
We post every change on this page with a new effective date. If a change is significant, we tell customers by email or in the app before it takes effect.
Contact
For questions or requests, email the privacy contact listed under Company details, or write to the address listed there.