Privacy Policy

This privacy policy explains how Loopa Technologies NZ Limited ("Loopa", "we", "us") collects, uses, shares and protects personal information when you use Loopa Pulse, our web application that helps real estate offices and agents create, schedule and publish social media posts about property news and their own listings.

We handle personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles.

Information we collect

Account information

When you register or are invited to Loopa Pulse, we collect your name, email address and password (stored only as a secure hash). You can also add a phone number, job title and profile photo. We record when you last signed in. If you sign in with Google or Facebook, we receive your name and email address from that service.

Office and organisation information

Details of the real estate office or organisation you belong to, such as its name, address, phone number, business registration number, logo, brand colour, website and billing email address.

Connected social media accounts

When you connect a Facebook Page, Instagram account or LinkedIn profile or Company Page, we receive and store the account's ID and name and the access tokens that let Loopa Pulse publish on your behalf. We only ask for the permissions needed to publish posts and show you how they performed.

Content you create

Posts, captions, images, templates and schedules you create or approve in Loopa Pulse, and a record of what was published, where and when.

Website and listing information

If you connect your office's website, we collect publicly available information from it, such as property listings, listing photos, agent profiles, and client testimonials (which can include the reviewer's name and rating), so that Loopa Pulse can suggest posts. We also collect publicly available property news articles from news websites.

Post performance

Performance figures for your published posts, provided by Facebook, Instagram and LinkedIn. These include reach, engagement, and audience breakdowns by age range, gender and location. These figures are aggregated percentages and do not identify individual people.

Payment information

Subscriptions are paid through Stripe. Your card details are entered on Stripe's secure checkout and are never received or stored by us. We keep your Stripe customer and subscription references and your subscription status.

Technical information

Like most web applications, our servers record technical information such as IP address, browser type, pages requested and error details. We use this to keep the service secure and working properly.

How we use your information

• to provide Loopa Pulse, including creating, scheduling and publishing posts to the social accounts you connect;
• to suggest content based on property news and your own listings;
• to show you how your posts are performing;
• to manage your account, your team and your subscription;
• to send you service emails, such as account invitations, password resets and verification codes;
• to keep the service secure, including verifying your identity before posts are published and preventing misuse;
• to fix problems and improve Loopa Pulse; and
• to meet our legal obligations.

We do not sell your personal information, and we do not use it for advertising.

Artificial intelligence

Loopa Pulse uses AI services to rewrite news articles and listing details into social media posts, to classify listings, and to generate images. To do this, the text or images being worked on are sent to our AI providers, Anthropic and OpenAI. We send only the content needed for the task, not your password or payment details. You review suggested posts before they are published.

Who we share information with

We share personal information only as needed to run Loopa Pulse, with:

• Other users in your office or organisation, who can see shared content, posts and connected accounts, according to their role;
• Social media platforms (Meta for Facebook and Instagram, and LinkedIn), when you connect an account and publish posts to it;
• Sign-in providers (Google and Facebook), if you choose to sign in with them;
• Service providers who help us run Loopa Pulse: Microsoft Azure (hosting, database and diagnostics), Stripe (payments), Mailjet (email delivery), ScrapingBee (collecting website content), and Anthropic and OpenAI (AI processing).

Our service providers may only use personal information to provide their services to us. We may also use or disclose personal information:

• where you have consented;
• where we believe it is necessary to prevent or lessen a serious threat to someone's life, health or safety, or to public health or safety;
• where it is required or authorised by law, for example to comply with a court order; or
• where it is necessary to avoid prejudice to the maintenance of the law, or for legal proceedings.

Storing information overseas

Loopa Pulse is hosted on Microsoft Azure in Australia, in its Sydney and Melbourne data centres, so your account and office information is stored there. Some of our other service providers, such as our payment, email and AI providers, process information in other countries, including the United States and Europe. When we send personal information overseas, we take reasonable steps to make sure it is protected in a way that is comparable to the New Zealand Privacy Act 2020.

Security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access. All connections to Loopa Pulse are encrypted with HTTPS. Access tokens for your connected social accounts are encrypted, using keys held in a separate secure key store. Passwords are stored as secure hashes. Access to our systems is restricted to authorised people, and a verification code is required before posts are published from a new session.

How long we keep information

We keep your information while your account is active and for as long as needed to provide the service, meet our legal and accounting obligations, and resolve disputes. When you disconnect a social account, we withdraw our access to it on that platform and stop using the connection. When information is no longer needed, we delete it or de-identify it.

Cookies

Loopa Pulse uses only the cookies it needs to work. We do not use advertising, retargeting or third-party analytics cookies in the Loopa Pulse app, and our cookies are not used to track you across other websites.

• Sign-in cookie: keeps you logged in to your account. It lasts up to 14 days and is extended while you keep using Loopa Pulse. Signing out removes it.
• Session cookie: holds short-term information while you use the app, for example while you connect a social account or confirm a post. It expires after 15 minutes of inactivity.
• Sign-in and connection cookies: short-lived cookies used while you sign in with Google or Facebook, or connect Facebook, Instagram or LinkedIn. They expire within 10 minutes.
• Security cookies: protect forms and sign-ins against forgery and misuse.
• Notification cookie: briefly carries one-off on-screen messages, such as confirmation that a post was scheduled, and is removed once shown.

These cookies hold random identifiers or encrypted data, not readable personal information. Because they are needed for Loopa Pulse to work, they cannot be turned off within the app. If you block them in your browser, you will not be able to sign in.

When you connect or sign in with Google, Facebook, Instagram, LinkedIn or Stripe, those services may set their own cookies on their own websites, under their own privacy policies.

Accessing, correcting and deleting your information

You can view and update most of your account and office details in Loopa Pulse under Settings, and disconnect social accounts at any time under My Connections.

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it. You can delete your account and personal information yourself under Settings > Delete account; our Data Deletion page explains what is removed. You can also ask us to do it. Email us at support@loopa.co.nz. We will respond within 20 working days. If we cannot meet your request, for example because the law requires us to keep certain records, we will tell you why.

If you signed in with Facebook or connected a Facebook Page or Instagram account, you can also remove Loopa Pulse from your Facebook settings under Apps and Websites, and ask for your data to be deleted there.

Children

Loopa Pulse is a business service for real estate professionals. It is not intended for children, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this privacy policy from time to time. We will post the updated policy on this page and change the "Last updated" date. If we make significant changes, we will let you know through Loopa Pulse or by email.

Contact us and complaints

If you have a question or concern about this privacy policy or how we handle your personal information, please contact our Privacy Officer:

Privacy Officer
Loopa Technologies NZ Limited
2/21 The Parade, St Heliers, Auckland 1071
support@loopa.co.nz

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner at www.privacy.org.nz.