Looped

Privacy Policy

Last Updated: October 8, 2026

1. Introduction

This Privacy Policy explains how Cardinal Blue Software (“Cardinal Blue”, “we”, “us”, or “our”) handles information when you use Looped, our digital invitations service at loopedinvites.com and in the Looped iOS app (the “Service”). By using the Service, you agree to the practices described here.

2. Information We Collect

Looped is an account-based service, so we collect:

  • Account information: your name, email address, phone number, and profile photo if you add one. Email and phone are used for one-time sign-in codes and for the event messages described in Section 6. If you sign in with Google or Apple, we receive your name and email address from them (with Apple, possibly a private relay address).
  • Content you create: the events you host (dates, locations, images, and text), your RSVPs, the photos and videos you add to an event’s album, and your messages, replies, reactions, and @mentions.
  • Safety information: the reports you file, the people you block, and reports others file about content you posted.
  • Technical information: IP address, browser and device information, and usage data, collected automatically for security and to improve the Service.

We rely on the following GDPR legal bases: contractual necessity for account information and content, and legitimate interests for safety and technical information.

3. Who Can See and Receive Your Information

An event page can be viewed by anyone with its invite link. Its album and activity feed, and what you post there, are visible to the host and to the people who responded to the event.

We do not sell or rent your personal information. We share it only with service providers that help us operate the Service — cloud hosting, storage, and bot protection (Cloudflare), email (Resend), SMS (Twilio), location search (Google, which receives what you type into the location field), sign-in (Google and Apple, if you use them), analytics (Amplitude and Google Analytics), measuring whether our ads lead people to Looped (Google Ads, on our website), error monitoring (Sentry), feedback forms (Typeform), and team alerts about reported content (Slack, which receives the reported content but no names or contact details) — and where required by law or to protect our rights, our users, or the public. These providers are contractually required to protect your information and use it only to provide services to us.

4. How We Use Your Information

We use this information to provide and manage your account, create event pages, collect RSVPs, share event albums, send Service-related communications, keep the Service secure, review reports, improve the Service, and comply with legal obligations.

5. Analytics

We use third-party analytics providers to understand and improve how the Service is used. They may set cookies and collect information such as device identifiers, IP address, and usage activity, governed by their own privacy policies.

6. Email and SMS Communications

We send communications needed to operate the Service: sign-in codes, RSVP confirmations, event reminders, @mention and reply notifications, event updates posted by a host whose event you responded to, and account and security notices, by email and SMS. Message frequency varies with the events you host or attend. You can opt out of text messages at any time by replying STOP, reply HELP for help, or contact us (Section 11), and we will honor opt-out requests promptly. Standard message and data rates may apply, and carriers are not liable for delayed or undelivered messages. Note that opting out of texts also stops the sign-in codes we send by SMS, so add an email address to your account if you rely on your phone number to sign in.

We do not sell, rent, or share your mobile phone number, or your consent to receive text messages, with third parties or affiliates for their own marketing purposes. We disclose your number only to the messaging providers that deliver these messages on our behalf, to the provider of our in-product feedback form when you choose to open it (so we can follow up on what you send), and where required by law.

7. Data Retention and Account Deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account at any time from your account page. Deleting it signs you out everywhere and permanently removes your name, email address, phone number, profile photo, sign-in connections, RSVPs, album photos and videos, reactions, and the text of your messages.

Some records stay, without your name or contact details: events you hosted remain viewable, read-only, to the people who could already see them; past RSVP entries in an event’s activity feed show as “Deleted user”; and reports stay on record as account and item identifiers. We may also keep information where we must retain it for legal, dispute-resolution, or security reasons, including a copy of content we removed for violating our Terms when the law requires us to report it.

8. Your Privacy Rights

EEA/UK (GDPR): You have the right to access, correct, delete, restrict, object to, and port your personal data, and to lodge a complaint with your local data protection authority.

California (CCPA/CPRA): You have the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell your personal information. You will not be discriminated against for exercising these rights.

You can delete your account yourself (Section 7). To exercise any other right, contact us using the details in Section 11.

9. Children’s Privacy

The Service is not directed to children under 13, and account holders must be at least 13 years old. We do not knowingly collect personal information from children under 13 without verifiable parental consent, and will delete any such information if we discover it. We do not knowingly sell or share the personal information of California residents under 16.

10. Data Security and International Transfers

We use commercially reasonable measures, including encryption in transit (TLS), to protect your information, though no method is completely secure. Your information may be stored and processed in the United States, Taiwan, and other countries where Cardinal Blue and its service providers operate. For transfers out of the EEA, UK, or Switzerland, we rely on adequacy decisions where available and otherwise on Standard Contractual Clauses and the UK Data Transfer Addendum.

11. Contact Us

For privacy questions or to exercise your rights, contact us at looped@cardinalblue.com or by mail at Cardinal Blue Software, P.O. Box 390677, Mountain View, CA 94039, USA.