Privacy Policy

Loop is owned and operated by Kavalry Technologies Private Limited (“Kavalry”, “we”, “us”, “our”). Our registered office is at 1st Floor, 316, 14th B Cross Road, 7th Main, Sector 6, HSR Layout, Bengaluru, Karnataka 560102, India. This Privacy Policy explains what personal information we collect when you use Loop, how we use it, who we share it with, and the choices you have.

We collect personal information in three ways: directly from you, automatically from your device, and through integrations you authorise.

Information you provide. When you create an account, log in through a Topmate-linked identity, or contact us, we collect your name, email address, phone number (if supplied), authentication credentials, and the company or brand you use Loop for. When you set up a loop, we collect the lead lists, contact information, past replies, voice samples, and tone-training material you submit or sync to the platform.

Information collected automatically. When you use Loop, our servers log usage and diagnostic information including IP address, device characteristics, browser type, operating system, referring pages, pages viewed, features used, send/call outcomes, timestamps, and error reports.

Information from integrations. If you sync your Topmate account, a connected calendar, or a CRM with Loop, we receive the data that integration is scoped to expose — typically your services list, recent bookings, contact records, and event metadata. Loop uses this only to populate your inbox and personalise the outreach you set up.

Sensitive information. Loop does not require, and we ask you not to submit, sensitive personal information (race, religion, political views, health details, biometric data, etc.) except where strictly necessary for the outreach you ask Loop to perform and lawful in your jurisdiction.

Payment data. Card details are collected and stored by our licensed payment processor and never touch our servers in full. We only receive the transaction confirmation, plan tier, and the last four digits of the card.

We process personal information to:

• create and authenticate your account and provide the Service;
• draft messages, place voice calls, run follow-ups, and surface conversations on your behalf, in your voice;
• process payments, manage subscriptions, and prevent payment fraud;
• respond to your questions, give support, and send service-related notices about security incidents, billing, and material product changes;
• improve Loop — including debugging issues, measuring feature adoption, and tuning models we have built or licensed for the Service;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms; and
• comply with our legal obligations and respond to lawful requests.

We do not sell your personal information. We do not use Customer Content to train shared, third-party foundation models unless you explicitly opt in.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on one of the following legal bases under the GDPR or UK GDPR:

• Performance of a contract — to provide Loop and the features you have signed up for;
• Legitimate interests — to keep the Service secure, prevent fraud, improve our product, and communicate with our users, balanced against your rights;
• Consent — where you have given us specific consent (for example, to enable voice calling on your behalf, or to receive marketing communications);
• Legal obligation — to comply with tax, accounting, anti-money- laundering, or law-enforcement requirements; and
• Vital interests — in the rare case we need to act to protect someone’s life or physical safety.

You can withdraw any consent you have given at any time by contacting us; withdrawal does not affect the lawfulness of processing already carried out.

We share personal information only with the service providers we need to run Loop and only to the extent each provider needs for its function. Each is bound by a written data-processing agreement that limits use of the data to our instructions and requires appropriate security safeguards.

• AI model and voice providers (such as OpenAI, Anthropic, and ElevenLabs) to generate drafts, transcribe call audio, and synthesise voice output;
• Email and telephony infrastructure (such as SendGrid, Postmark, Twilio, or equivalent) to deliver messages and place calls;
• Hosting, storage, and security (such as AWS, GCP, Cloudflare, and Vercel) to operate the Service and protect it from abuse;
• Product analytics and error monitoring to understand how Loop is used and to detect bugs;
• Payment processors to handle billing.

We may also disclose information when we are legally required to do so (in response to a court order, government request, or subpoena), to enforce our Terms, to defend our rights, or to protect the safety of our users or the public. If Loop is involved in a merger, acquisition, or sale of assets, your personal information may be transferred to the successor entity subject to the protections of this Policy.

We use a small number of strictly necessary cookies to keep you logged in, remember your preferences, and protect against fraud and abuse. We use first-party analytics cookies to measure aggregate product usage. We do not run third-party advertising cookies, and Loop does not include trackers used for cross-site targeted advertising. You can configure your browser to refuse cookies, but parts of Loop may not function correctly if you do.

Loop is, by design, an AI agent. The content of the emails Loop sends, the AI-voice calls Loop places, and the replies Loop drafts on your behalf are generated by machine-learning models — some hosted by us, some operated by the third-party providers listed above. When Loop generates content using a third-party AI provider, the inputs you supply (your tone samples, the lead context, the goal you typed in) and the outputs the model returns are processed by that provider under their applicable terms and data protections.

Voice samples that you provide so Loop can sound like you are processed for the purpose of synthesising your voice for outbound calls. We do not use your voice samples to train shared voice models accessible to other users, and we do not license your voice to third parties.

You can disable AI voice calling and AI drafting from your settings at any time. If you do, Loop’s outreach capabilities will be limited accordingly.

We keep your account information and Customer Content for as long as your account is active. When you close your account, we delete or anonymise it within ninety (90) days, except where law requires us to keep specific records for longer (for example, tax filings, fraud investigations, or active legal-hold obligations). Routine system backups are encrypted and roll off on a thirty-five (35) day cycle.

Aggregated, anonymised statistics that no longer identify any individual may be retained indefinitely for analytics and product improvement.

We use industry-standard technical and organisational measures to protect personal information: encryption in transit and at rest, scoped role-based access for staff, audit logging, principle-of-least-privilege provisioning, and periodic penetration testing. No system is perfectly secure; despite our efforts, we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law.

Loop is operated from India, and our service providers may be located in the United States, the European Union, the United Kingdom, and other jurisdictions. Where we transfer personal information across borders, we rely on appropriate safeguards — including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or equivalent mechanisms — to make sure your information continues to be protected.

Loop is not directed at children and we do not knowingly collect personal information from anyone under the age of eighteen (18). If you believe a child has provided us with personal information, contact us and we will delete it.

Depending on where you live, you may have the following rights with respect to your personal information: to access it, to receive a copy in a portable format, to correct inaccuracies, to ask us to delete it, to restrict or object to certain processing, to withdraw consent you have given, and to not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You can exercise most of these rights from your account settings or by emailing support@topmate.io. We respond to verified requests within thirty (30) days. We may need to verify your identity before acting on a request. If you are dissatisfied with how we handle a request, you have the right to complain to your local data-protection regulator (for example, your supervisory authority in the EEA or UK, the Federal Data Protection and Information Commissioner in Switzerland, or the Data Protection Board in India once constituted under the DPDP Act).

If you reside in a US state with a comprehensive privacy law (currently including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia), you have the right to request access to the personal information we hold about you, to correct inaccuracies, to obtain a portable copy, and to delete it, subject to limits in applicable law.

We do not sell personal information, and we have not sold or shared personal information for cross-context targeted advertising in the preceding twelve (12) months. If our practices ever change, we will update this Policy and provide the opt-outs required by law. To exercise your rights, email support@topmate.io. You may authorise an agent to make a request on your behalf with written authorisation. If we deny a request, you may appeal by replying to our response.

Australia and New Zealand. We handle personal information in line with the Australian Privacy Principles (Privacy Act, 1988) and the New Zealand Information Privacy Principles (Privacy Act, 2020). You can access or correct your personal information by emailing us, and may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner respectively.

South Africa. We process personal information in accordance with POPIA. You may complain to the Information Regulator (South Africa).

India. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the Rules notified under it. Our Grievance Officer (named in our Terms of Service) is also responsible for handling DPDP-related requests.

Some browsers and operating systems offer a “Do-Not-Track” signal. Because no standard yet exists for honouring DNT signals in a uniform way, Loop does not currently respond to them. If an industry standard is established and becomes mandatory, we will update this Policy accordingly.

We update this Policy when our practices or applicable law change. The “Last updated” date at the top of the page indicates when it was last revised. We will notify you of material changes by email or through an in-product notice at least thirty (30) days before they take effect, unless a shorter notice is required by law. Continued use of Loop after the effective date of a change means you accept the updated Policy.

Questions, requests, or complaints about this Policy or how we handle your data: email support@topmate.io. Postal: Kavalry Technologies Private Limited, 1st Floor, 316, 14th B Cross Road, 7th Main, Sector 6, HSR Layout, Bengaluru, Karnataka 560102, India.