Privacy Policy

Effective Date: October 5, 2026

1. Who We Are & Contact

Loomis Technologies LLC (Brand: "Loomis by O2mation") operates the Loomis platform. For privacy requests, contact us at legal@loomis.ai.

2. Scope

This Privacy Policy applies to two tiers of users:

  • Business Customers (Tenants): The organizations that create an account on Loomis to automate support.
  • End-Users: The individuals who interact with our business customers' chatbots via Facebook, Instagram, Telegram, or Web.

3. Information We Collect

From Business Customers:

  • Account Data: Email, password hash (Supabase Auth), business name, org/user UUIDs, staff roles.
  • Integrations: Encrypted OAuth tokens (Meta long-lived user/page access tokens, Telegram bot tokens).
  • Knowledge Base: PDF filenames and extracted text content. (Binary PDFs are discarded immediately after extraction).
  • Billing: Stripe customer ID, subscription ID, payment intent IDs, credit transaction ledger.
  • Telemetry: Model usage, latency, token counts, cost per message.
  • Webhooks: Event IDs and timestamps (for deduplication).

From End-Users:

  • Identifiers: Meta scoped user IDs, Telegram chat IDs, website visitor UUIDs.
  • Profile Info: First and last name fetched from Meta Graph API for Facebook/Instagram.
  • Chat Data: Full chat transcripts, AI-generated escalation summaries, session timestamps.

4. How We Use Information

We use this information to operate, maintain, and provide the features of the Services, process payments, and facilitate the AI generation of responses for your end-users.

5. Third-Party Sub-Processors

We rely on the following sub-processors:

  • Google LLC: Gemini AI API (receives chat messages, knowledge docs, voice audio).
  • Meta Platforms Inc.: Facebook/Instagram Graph API.
  • Telegram FZ-LLC: Bot API.
  • Supabase Inc.: PostgreSQL database, auth, realtime (AWS hosted).
  • Stripe Inc.: Payment processing.

6. Voice & Audio Processing

Voice messages are streamed in-memory to Google Gemini AI API for processing. The audio is NOT stored on our servers, nor is it transcribed to our database. Our database only records a "[Voice Message]" placeholder.

7. AI-Generated Lead Capture

Our AI actively monitors conversations for purchase intent. When detected, the AI may extract contact information (such as email or phone number) provided by the end-user during the chat to assist our business customers with lead capture.

8. Comment Automation & Public Data

If enabled, we process public comment data from Meta, including comment content, commenter platform IDs, post IDs, and automation action logs to reply to users or send automated DMs.

9. Website Chat Widget & Local Storage

Our embeddable Web Chat Widget uses localStorage on host websites to maintain session continuity (e.g., loomis_session_{botId}). See our Cookie Notice for details.

10. Data Retention

Currently, chat transcripts and operational data are retained indefinitely to provide the Services. We plan to introduce configurable retention policies for business customers in the future.

11. Data Security

We employ industry-standard security measures, including Fernet AES-128 encryption for all OAuth tokens at rest, HTTPS for transit, and Supabase Row Level Security (RLS) to enforce tenant isolation.

12. Your Rights

GDPR: You have the right to access, rectification, erasure, portability, restriction, and objection.
CCPA: You have the right to know, delete, opt-out of sales, and non-discrimination.

13. International Transfers

Data is processed by Google and Supabase on AWS US-East infrastructure. We rely on Standard Contractual Clauses (SCCs) where applicable.

14. Children's Privacy

Our service is not directed to children under 13, and we do not knowingly collect personal information from children.

15. Meta-Specific Disclosures

We request the following Meta OAuth scopes to operate:

  • pages_show_list: To list the Facebook Pages you manage.
  • pages_manage_metadata: To subscribe to webhooks for your Pages.
  • pages_messaging: To send and receive messages on Facebook Messenger.
  • instagram_basic: To read basic Instagram account information.
  • instagram_manage_messages: To send and receive messages on Instagram Direct.
  • pages_read_engagement: To read page posts and comments.
  • instagram_manage_comments: To read and reply to Instagram comments.
  • pages_manage_engagement: To read and reply to Facebook comments.
  • pages_read_user_content: To read public posts and comments on your Facebook Pages for comment automation.
  • business_management: To manage assets and permissions associated with your Business Manager account.
  • instagram_manage_engagement: To like and reply to Instagram comments as part of the Comment-to-DM automation feature.

16. Changes to This Policy

We may update this policy periodically. Your continued use of the Services indicates acceptance of the updated policy.

17. Contact for Privacy Requests

For data deletion, access requests, or other privacy matters, email us at legal@loomis.ai.