Privacy notice

Controller

Jimmy is the controller of personal data processed through LoopAndStack. Contact: privacy@loopandstack.com. Stockholm, Sweden

What we process and why

Account: name, email, and sign-in identifiers from email/password or from Google / X via the Grok auth broker. Legal basis: contract (GDPR Art. 6(1)(b)).

Canvas: GIFs you plant, title, handle, optional link, position, and cost. Legal basis: contract. This content is public on the lot.

Wallet and purchases: credit balance, pack, amount, Stripe session id. Legal basis: contract, and legal obligation for accounting records (Art. 6(1)(c)).

Moderation: reports you send; a still frame of a loop may be sent to xAI (Grok) to score risk. Legal basis: legitimate interests in keeping the lot lawful and usable (Art. 6(1)(f)), and legal obligation under the DSA to act on illegal content.

Security: session cookies, and (on the auth tables) IP and user-agent on sessions. Legal basis: legitimate interests in securing the service.

Processors and transfers

Stripe processes card payments. Google and X (via the Grok auth broker at auth.grok.me) process social sign-in if you choose those buttons. xAI processes a still of a loop when a moderator runs AI review.

Some processors are in the United States. Where required, transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

Cookies

We only set strictly necessary cookies: a session cookie so you stay signed in, and a short-lived cookie-cache for that session. We do not use advertising, analytics, or social-pixel cookies. Strictly necessary cookies do not require consent under ePrivacy, but you can still close your account and clear your browser.

Retention

Account and loops: until you delete the account, or we remove illegal content sooner.

Operator backups may keep a snapshot for a short time; a restore will not bring back an account that has already been deleted.

Payment records: kept in anonymised form for up to 10 years where accounting law requires.

Reports and moderation notes: up to 2 years, or longer if a dispute is open.

Your rights

You have the right to access, rectify, erase, restrict, port, and object, and to complain to your EU/EEA/UK data protection authority (for example IMY in Sweden, or your local authority).

Export and delete are on your account page and run immediately. You can also email the contact above. We will not sell your data.

No solely automated decision produces legal or similarly significant effects. Grok review is an aid for human moderators.

Children

LoopAndStack is not for anyone under 18. We do not knowingly keep accounts for children.