Privacy policy

1. Who is responsible

The controller is HAZEL LABS, računalniško programiranje, d.o.o., Litostrojska cesta 42B, 1000 Ljubljana, Slovenia. Company registration number: 9041265000. VAT ID: SI33997250. Privacy contact: info@thelooma.io.

We have not appointed a Data Protection Officer. The processing described here does not meet the conditions in Article 37 of the GDPR. If that changes we will appoint one and say so here.

2. What we collect

We collect the following data when it is relevant to how you use the website or platform:

• When you book a call: your name, your email address, whatever you type into the booking form, and the slot you chose.
• When you message us on WhatsApp: your phone number and the messages you send.
• When you use the website contact form: your name, email address, company if supplied, message, and the page from which you sent it.
• When you use the platform: your account and workspace details, access role, prompts, files, approvals, settings, activity records and the content needed to provide the features you use.
• When you connect a service: the connection details and authorisation needed to use it. Credentials and tokens are used only to provide the connection and are not published.
• If you accept analytics: the pages you view, how you arrived, an approximate location derived from your IP address, your device and browser, and interactions such as clicks and scrolling.
• If you accept advertising measurement: page views and actions such as opening or booking a call, together with browser and campaign identifiers used by Meta.

3. What we use it for

• To answer enquiries, arrange calls and prepare an offer.
• To create and administer platform accounts, configure workspaces, provide requested agent features, support users and keep an audit and security record.
• To measure and improve the website when you consent to analytics.
• To measure advertising and campaign response when you consent to advertising measurement.
• To prevent abuse, protect the service, enforce agreements and comply with legal obligations.

4. Legal bases

• Consent, Article 6(1)(a): analytics and advertising measurement. You may withdraw it at any time.
• Steps before a contract and performance of a contract, Article 6(1)(b): enquiries, bookings, proposals, platform accounts and delivery of agreed services.
• Legitimate interest, Article 6(1)(f): service security, abuse prevention, support, necessary business records and improving non-tracking parts of the service, balanced against your rights.
• Legal obligation, Article 6(1)(c): records and disclosures required by law, including accounting records once you become a client.

5. Cookies and similar storage

We store your cookie choice in local storage under the key thelooma-consent. This is necessary to remember whether you accepted or rejected each optional purpose. It stays until you change it or clear browser storage.

Nothing that measures you loads before you choose. You can allow analytics and advertising measurement separately. Cookie settings in the footer lets you change or withdraw either choice at any time.

• Google Analytics 4, analytics: _ga and _ga_G-F179GE45DL, normally up to 2 years, distinguish visitors and preserve session state.
• Microsoft Clarity, analytics: _clck and _clsk plus Microsoft identifiers such as CLID, ANONCHK, MR, MUID and SM. They connect page views, session recordings and heatmaps. Typical duration ranges from the browser session to 1 year.
• Meta Pixel, advertising measurement: _fbp and related Meta identifiers, normally up to 3 months, measure page views and actions after an ad or campaign visit.
• Campaign labels, advertising measurement: thelooma-consent-utm in session storage, kept only for the current browser session and passed to Calendly if you book.

6. Analytics and advertising measurement

If you allow analytics, Google Analytics 4 measures visits and events, and Microsoft Clarity records interactions and creates session replays and heatmaps. Form fields are masked from Clarity. Google Analytics event and user data is configured to be retained for 14 months.

If you allow advertising measurement, the Meta Pixel records page views and selected actions such as opening or booking a call. Campaign labels are kept for the browser session so they can be passed to Calendly.

Rejecting a category prevents its scripts from loading. Withdrawing a previous choice stops future collection, clears the first-party measurement cookies we can clear and reloads the page without the rejected tools. Provider-controlled cookies can also be removed through your browser settings.

7. Enquiries, bookings and messaging

Website form submissions go to the thelooma platform and become an inbound request that a person reviews. Submitting a form does not enrol you in an automated sequence.

Calendly processes booking details on our behalf and may also process some information under its own privacy notice. WhatsApp is operated by Meta and applies its own terms when you choose to message us there.

8. Platform and client data

For account administration, billing, security and our direct relationship with platform users, Hazel Labs is the controller.

For personal data a client places in its workspace or asks an agent to process about its customers, prospects or staff, the client normally decides the purpose and means. Hazel Labs then acts as processor and uses the data only to provide the agreed service, support it, protect it and follow the client’s lawful instructions.

The client is responsible for giving affected people any required notices and for having a lawful basis for the data and activity it asks the platform to handle.

9. Who receives data

We do not sell your personal data. These providers process it on our behalf or as part of a service you chose to use:

• Neoserv, Slovenia: hosting for the website, platform and database.
• Calendly, United States: the booking form and the calendar behind it.
• Google for Analytics 4, Microsoft for Clarity, and Meta for the Pixel: only for the purpose you accept.
• Meta for WhatsApp if you contact us that way.
• Backblaze, European Union: media and encrypted backup storage used by the platform.
• The model, publishing, advertising, email, hosting, lead-data or other integration provider chosen or authorised for a client workspace. The exact providers depend on the connected features and are identified in the client agreement or subprocessor information.

10. International transfers

The website and core platform are hosted in Slovenia. Some providers process data in the United States or other countries outside the European Economic Area.

Calendly, Google, Microsoft and Meta state that they participate in the EU-US Data Privacy Framework. Their applicable data terms also use European Commission Standard Contractual Clauses where the Framework does not apply. Other transfers use an adequacy decision, Standard Contractual Clauses or another safeguard permitted by Chapter V of the GDPR.

11. How long we keep it

Enquiries and booking records that do not become a client relationship are kept for up to 24 months after the last meaningful contact, then deleted or anonymised unless they are needed for a legal claim.

Platform account and workspace data is kept while the service is active and then handled under the client agreement, including agreed export and deletion periods. Security and audit records are kept only as long as reasonably needed to protect the service and establish what happened.

Google Analytics event and user data is retained for 14 months. Cookie and browser-storage durations are listed in section 5. Accounting and contract records are kept for the period required by Slovenian law.

12. Your rights

Under the GDPR you may ask us to:

• give you a copy of the personal data we hold about you
• correct it if it is wrong or incomplete
• delete it
• restrict how we use it, or object to our using it under legitimate interest
• send it to you, or to someone else, in a machine-readable form
• withdraw a consent you gave, which does not affect what we did before you withdrew it

13. How to reach us, and how to complain

Send a privacy request to info@thelooma.io. You can also write to Hazel Labs d.o.o., Litostrojska cesta 42B, 1000 Ljubljana. We respond without undue delay and normally within one month.

If you think we have handled your data badly you can complain to the Information Commissioner of the Republic of Slovenia at ip-rs.si, or to the supervisory authority where you live.

14. Security and children

We use access controls, encrypted connections, credential protection, backups and logging appropriate to the service. No service can be guaranteed completely secure, so please tell us promptly at info@thelooma.io if you suspect a problem.

The website and platform are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16.

15. Changes to this policy

We may update this page. The date at the top is the last change. If a change matters to you, we will say so on the site rather than only changing the date.