Meta Pixel

Privacy Policy

Last updated: November 1, 2026

1. Information We Collect

We collect information you provide directly to us, including:

  • Name and email address when you create an account
  • Payment information when you subscribe to a paid plan (processed securely by Creem, our payment provider)
  • Business information you provide during onboarding (product details, website URLs, business descriptions)
  • Data from the accounts you connect: ad account data (campaign performance, creative assets, audience data) and, if you connect Google Analytics, Search Console, Merchant Center or Tag Manager, the properties, sites, accounts, containers and reports you ask about
  • Communications you send to us (support requests, feedback)
  • Answers you give in our onboarding quiz before you create an account (for example how you run ads today and which AI assistant you want to use), which we link to your account if you go on to sign up

2. Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

  • IP address and approximate geographic location
  • Browser type, version, and language preferences
  • Device type, operating system, and screen resolution
  • Pages visited, features used, and time spent on the Service
  • Referring URL and how you arrived at our website
  • Interaction data such as clicks, scrolls, and navigation patterns

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our AI advertising services
  • Generate AI-powered ad creatives, images, and campaign recommendations
  • Optimize your ad campaigns and generate performance insights
  • Process payments and manage your subscription
  • Send you updates, marketing communications, and product announcements
  • Respond to your comments, questions, and support requests
  • Monitor and analyze trends, usage, and activities in connection with our services
  • Detect, investigate, and prevent fraudulent transactions and other illegal activities

4. AI Processing

LoomaScale uses artificial intelligence to generate ad creatives, analyze products, and optimize campaigns. When you use our AI features:

  • Your product information, business descriptions, and website data may be processed by AI models to generate relevant content
  • AI-generated outputs are created specifically for your campaigns and are not shared with other users
  • We do not use data received through or returned to an AI assistant connector (such as ChatGPT, Claude or Muse) to train, fine-tune or improve any AI model, our own or a third party's, and LoomaScale does not train AI models of its own
  • We do not use your personal information or identifiable business data to train third-party AI models

5. Data Sharing

We do not sell your personal information. We may share your information with:

  • Payment processors — Creem processes your payment information securely. We do not store your credit card details.
  • Service providers — third-party providers who perform services on our behalf, such as hosting, analytics, and email delivery. Our application server and database are hosted on Amazon Web Services (Amazon EC2, eu-west-1 region, Ireland). These providers are contractually obligated to use your data only as necessary to provide services to us.
  • Advertising and analytics platforms — when you connect your ad accounts or Google data sources, data flows between LoomaScale and the connected platforms (Meta, Google and LinkedIn) as necessary to manage your campaigns and answer your questions.
  • Assistant platforms — if you connect LoomaScale to an AI assistant (for example ChatGPT or Codex, through OpenAI; Claude or Claude Code, through Anthropic; Slackbot, through Slack; Manus; or Muse), the answers we return to your questions (ad account, Facebook Page, campaign, ad set and ad names and ids, Google Analytics property, Search Console site, Merchant Center account and Tag Manager container names, and the performance and analytics figures you asked for) are delivered into that conversation and processed by the assistant's provider to render the reply.
  • Advertising measurement — we send conversion events about our own marketing (such as a signup or a purchase) to Meta's Conversions API and to Google Ads, including a hashed form of your email address, so that the ads that brought you here can be measured.
  • Operational alerts — our team receives internal notifications about account activity (for example a new signup or a failed connection) through Telegram, and those messages may contain your email address.
  • Legal requirements — we may disclose your information if required by law, regulation, or legal process.

6. Ad Account and Analytics Data

When you connect your ad accounts (Google Ads, Meta Ads, LinkedIn Ads) or Google data sources (Google Analytics, Search Console, Merchant Center, Tag Manager), we access your data through official platform APIs. This data is used exclusively to manage your campaigns, answer your questions and provide performance insights. It is never shared with other users or sold to third parties. You can disconnect your accounts and request data deletion at any time.

6.1 Google Permissions We Request

When you connect Google, LoomaScale asks only for the permissions the feature you are connecting needs, each on Google's own consent screen:

  • Sign-in (openid, email, profile) — your name, email address and Google account identifier, used to create your LoomaScale account and sign you in.
  • Google Ads (https://www.googleapis.com/auth/adwords) — read and manage the Google Ads accounts you allow: campaigns, ad groups, ads, keywords, budgets, assets, conversion actions and performance reports. Changes are made only when you ask for them, within the limits described in our Terms of Service.
  • Google Analytics (https://www.googleapis.com/auth/analytics.readonly) — read-only access to the Google Analytics 4 accounts and properties your Google login can view: property settings and reports such as sessions, users, conversions and traffic sources. LoomaScale cannot change your Analytics configuration or data.
  • Google Search Console (https://www.googleapis.com/auth/webmasters.readonly) — read-only access to the Search Console properties your Google login can view: organic search performance (queries, pages, clicks, impressions, positions), the index status of your URLs and your submitted sitemaps. LoomaScale cannot submit, remove or change anything in Search Console.
  • Google Merchant Center (https://www.googleapis.com/auth/content) — access to the Merchant Center accounts your Google login can use: product approval statuses and issues, product and price reports, and account-level issues. Google offers no read-only Merchant Center permission, so this one is technically read/write; LoomaScale only ever reads with it and never adds, changes or removes products, feeds or settings.
  • Google Tag Manager (https://www.googleapis.com/auth/tagmanager.readonly) — read-only access to the Tag Manager accounts and containers your Google login can use: tags, triggers, variables, published versions and unpublished workspace changes. With this permission alone LoomaScale never creates, edits, publishes or deletes anything in Tag Manager.
  • Google Tag Manager editing (https://www.googleapis.com/auth/tagmanager.edit.containers) — requested only when you press "Enable editing" on the Tag Manager connection card: lets LoomaScale create and change tags, triggers and variables in a draft workspace of your container, at your assistant's request. It cannot publish a container version or delete anything, so nothing on your website changes until you publish the workspace in Tag Manager.

We store the access and refresh tokens Google issues (encrypted at rest), the names and identifiers of the Google Ads accounts, Google Analytics properties, Search Console properties, Merchant Center accounts and Tag Manager containers available to your login, and, for Google Ads, account-level spend and budget totals used to apply your daily spend cap. Google Analytics, Search Console, Merchant Center and Tag Manager reports are fetched live when you ask for them and are not stored in our database.

6.2 Google API Services User Data Policy

LoomaScale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:

  • We use Google user data only to provide and improve the user-facing features you use it for: answering your questions about your Google Ads, Google Analytics, Search Console, Merchant Center and Tag Manager accounts and making the Google Ads changes you request.
  • We transfer it only to provide those features — to the AI assistant you connected (for example ChatGPT, Claude or Muse), in reply to your own requests — or to comply with applicable law, or as part of a merger, acquisition or sale of assets after notice to you.
  • We do not use or transfer it to serve advertising, including retargeting, personalized or interest-based ads, and we do not sell it.
  • We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
  • No one at LoomaScale reads it unless you give us permission for a specific request (for example a support request), it is needed for security purposes such as investigating abuse, it is required by law, or it has been aggregated and anonymized for internal operations.

6.3 LinkedIn Permissions We Request

When you connect LinkedIn Ads, LoomaScale asks for these permissions on LinkedIn's own consent screen:

  • Profile (r_basicprofile) — your LinkedIn name and member identifier, used to label the connection in your dashboard.
  • Ad accounts (r_ads) — read access to the LinkedIn ad accounts your login can use: the accounts, campaign groups, campaigns and their settings.
  • Reporting (r_ads_reporting) — read access to the performance reports of those accounts, such as spend, impressions, clicks, conversions and aggregated audience demographics.

LoomaScale's LinkedIn access is read-only: it never creates, edits, pauses or deletes anything in LinkedIn Campaign Manager. We store the tokens LinkedIn issues (encrypted at rest) and the names and identifiers of the ad accounts available to your login. LinkedIn reports are fetched live when you ask for them and are not stored in our database. We use LinkedIn data only to answer your own questions, in the dashboard or through the AI assistant you connected; we do not sell it, use it for advertising, or use it to train AI models.

7. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest (AES-256), regular security audits, and strict access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. We encourage you to use strong, unique passwords for your account.

8. Cookies and Tracking

We use cookies and similar tracking technologies to collect and track information about your use of our website. This includes analytics cookies to understand how visitors interact with our site and functional cookies to remember your preferences. See our Cookie Policy for more details.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy, including the use of standard contractual clauses where required.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you request deletion, we will remove your data within 30 days, except where we are required by law to retain it. Anonymized and aggregated data may be retained indefinitely for analytics and service improvement purposes.

11. Your Rights

Depending on your location, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate data
  • Request deletion of your personal data
  • Object to or restrict certain processing of your data
  • Data portability — receive your data in a structured, machine-readable format
  • Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at team@loomascale.com.

12. GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), we process your personal data on the following lawful bases:

  • Contract performance — processing necessary to provide the Service you subscribed to
  • Legitimate interests — improving our services, preventing fraud, and ensuring security
  • Consent — where you have given explicit consent, such as for marketing communications
  • Legal obligation — where processing is required by applicable law

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated. For data protection inquiries, contact us at team@loomascale.com.

13. CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

  • Right to know — you can request details about the personal information we collect, use, and share
  • Right to delete — you can request deletion of your personal information, subject to certain exceptions
  • Right to opt-out — we do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" option.
  • Non-discrimination — we will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at team@loomascale.com.

14. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at team@loomascale.com.

15. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For material changes, we will provide additional notice via email or through the Service. Your continued use of our services after any changes constitutes acceptance of the updated policy.

16. Third-Party AI Services

LoomaScale uses third-party artificial intelligence services to power its features. By using our Service, your data may be processed by the following providers:

  • Google Gemini — used for AI image generation and text content creation. Product descriptions, prompts, and uploaded images may be sent to Google's API for processing.
  • Creem — used for content moderation. Text prompts submitted for image generation are reviewed by Creem's moderation API to ensure compliance with content policies.
  • OpenAI — LoomaScale is available as a connector inside ChatGPT and Codex. When you manage advertising through that connector, the data we return in answer to your requests — including connected ad account, Facebook Page, campaign, ad set and ad names and identifiers, Google Analytics property, Search Console site, Merchant Center account and Tag Manager container names, and the performance and analytics figures you asked for — is delivered into your ChatGPT or Codex conversation and processed by OpenAI in order to produce the assistant's reply to you.
  • Anthropic — LoomaScale is available as a connector inside Claude, listed in Claude's connector directory, and inside Claude Code. When you manage advertising through that connector, the same data described above is delivered into your Claude or Claude Code conversation and processed by Anthropic in order to produce the assistant's reply to you.
  • Slack — LoomaScale is available as an app in Slack. When you ask Slackbot about your advertising, the same data described above is delivered into your Slack conversation and processed by Slack (a Salesforce company) in order to produce Slackbot's reply to you, under the agreements that govern your Slack workspace.
  • Other AI assistants — LoomaScale is also available as a connector inside other AI assistants that support the Model Context Protocol, such as Manus or Muse. When you manage advertising through one of these connectors, the same data described above is delivered into that conversation and processed by that assistant's provider in order to produce the assistant's reply to you.

We only share the minimum data necessary for each service to function. These providers process data in accordance with their own privacy policies and data processing agreements. We do not share your payment details with these AI service providers. Advertising account, analytics and other connected-account data is shared only with the assistant provider you connected (for example OpenAI for ChatGPT or Anthropic for Claude), and only for the connector described above, in response to your own requests; it is never shared with Google Gemini or Creem.

17. Contact Us

If you have any questions about this Privacy Policy, please contact us at team@loomascale.com.