Privacy Policy

This policy explains what OnceLoop (“we,” “us”) collects, why, and your choices. We kept it plain on purpose. If anything is unclear, email hello@onceloop.com.

What we collect

• Account: your email address, and if you use “Sign in with Google,” your basic Google profile (name, email). That's all we receive from Google, and we use it only to sign you in.
• Your content: the recordings, transcripts, and text you submit to generate output.
• Usage: counts of your generations, so we can enforce plan limits, plus basic technical logs (like IP address) for security and rate-limiting.
• Payment: if you subscribe, Stripe collects and processes your payment details. We never see or store your full card number.

How we use it, and our legal basis

We use your data to run the service: generate your content, sign you in, enforce your plan, take payment, keep the service secure, and reply to you. For anyone in the EU/UK, our legal bases are performing our contract with you (providing the service you signed up for) and our legitimate interests (security, preventing abuse, and improving the product). We'd only rely on consent if we ever added optional tracking, which today we don't.

What we don't do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, and we haven't in the past 12 months. We don't run advertising or analytics trackers, and we don't use your recordings or content to train our own models. We also don't permit the AI providers we use to train their models on your inputs (see below).

Who we share it with (our providers)

We use a small set of trusted providers to run OnceLoop, and share only what each needs to do its job:

• Supabase — accounts and database (Canada).
• Stripe — payment processing (US).
• Vercel — hosting and temporary file storage (US).
• Upstash — rate-limiting (US).
• Deepgram — transcribing the audio and video you submit (US).
• Anthropic and OpenRouter — generating the written content (US).
• Google — optional sign-in (US).

AI providers and your inputs

To generate your content, we send your transcript or media to our transcription and AI providers. We don't use your content to train our own models, and we don't permit these providers to train theirs on it: their business API terms prohibit training on data we send, and we don't turn on any optional data-sharing or prompt-logging features. They keep request data only briefly to run and troubleshoot the service (for example, Anthropic's API retains logs for a short window), then delete it under their own policies.

Cookies

We use only strictly necessary cookies, to keep you signed in and to protect the service. We don't use advertising or analytics cookies and we don't track you across other sites, so there's no consent banner to click through. If we ever add optional analytics, we'll ask first where the law requires it.

How long we keep it

Uploaded source files are deleted automatically shortly after we process them. Your account data (email, usage counts) is kept while your account is active and for a short period after you delete it, except where we must keep records longer (for example, Stripe retains payment records to meet its legal obligations). Copies may persist briefly in routine backups. You can delete your account and its data anytime from your account page or by emailing us, and we'll take care of it within the timelines the law requires.

Where your data is processed

OnceLoop is operated from the United States, and your data is processed in the United States and Canada (where our database is hosted), and by our providers listed above. If you use OnceLoop from outside these countries, you understand your data is transferred and processed there, protected by the safeguards our providers maintain for international transfers.

Your rights

Wherever you live, you can ask us to access, correct, or delete your personal information, or to give you a copy, and we won't treat you differently for asking. If you're in California, that includes the rights to know, delete, correct, and opt out of sale or sharing (we don't sell or share, so there's nothing to opt out of), and to limit use of sensitive information. If you're in the EU/UK, you also have the rights to restrict or object to processing, to portability, and to complain to your local data protection authority. To exercise any of these, email hello@onceloop.com and we'll verify and respond within the required time.

Security

We protect your data with encryption in transit and at rest, access controls, and infrastructure providers that maintain recognized security certifications; Stripe handles card data under PCI standards so we never touch it. No method of transmission or storage is ever 100% secure, so we can't promise absolute security, but we work to keep your data safe and to fix issues quickly.

Children

OnceLoop is for adults. You must be at least 18 to use it, it isn't directed at children, and we don't knowingly collect data from anyone under 18. If we learn we have, we'll delete it.

If there's ever a breach

If a data breach affects your personal information, we'll notify you and the relevant authorities as required by applicable law.

Changes

If we update this policy, we'll change the date above and, for material changes, let you know. We review it at least once a year.

Contact

Questions about your data, or want to exercise a right? Email hello@onceloop.com.