Privacy Policy.

A notice under the Digital Personal Data Protection Act, 2023 (India) and the GDPR. Effective 27 June 2026. Last updated 27 June 2026.

1. Who runs Loop

Loop is an independent personal product built and operated by an individual ("Operator"). For the purposes of the DPDP Act, 2023 the Operator is the Data Fiduciary. For the GDPR the Operator is the Data Controller. Contact for any privacy matter: komalsrinivasan.l@gmail.com.

2. Scope

This notice covers loop.komalvardhan.com and the waitlist form on it. It does not cover other sites you may reach from links here.

3. Personal data collected, and why

3.1 Waitlist form

• Data: name, email, phone number (optional), selected plan tier.
• Purpose: contacting you when access opens, gauging plan demand for product planning.
• Lawful basis: consent (DPDP s.6 / GDPR Art. 6(1)(a)).
• Retention: until access opens for you, or 24 months from sign-up, whichever is sooner. Then deleted unless you become a paying user (then governed by a future service agreement).

3.2 Server logs

• Data: IP, user-agent, requested URL, timestamp.
• Purpose: security, abuse prevention.
• Lawful basis: legitimate use (DPDP s.7(i) / GDPR Art. 6(1)(f)).
• Retention: 30 days.

4. Sensitive personal data

Loop does not knowingly collect financial information, biometric data, health data, or any other sensitive personal data through the waitlist form.

5. Processors

• Vercel Inc. (United States) - hosting.
• Supabase Inc. (United States, Postgres in us-east-1) - database.
• Resend, Inc. (United States) - transactional and confirmation email.

6. Cross-border transfer

Because the processors above are in the United States, your data leaves India. This is permitted under DPDP s.16 and under GDPR Chapter V via the standard contractual clauses these providers operate under.

7. Your rights as a Data Principal / Data Subject

Under DPDP s.11-15 and GDPR Art. 15-22 you can ask the Operator to:

• Confirm whether your data is held, and give you a copy.
• Correct inaccurate data.
• Erase your data.
• Withdraw your consent at any time, with the same ease you gave it.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity (DPDP s.14).
• Receive your data in a portable, machine-readable format.

To exercise any of these, email komalsrinivasan.l@gmail.com with the subject DPDP request or GDPR request. Response within 7 days, completion within 30 days at the outside.

8. Grievance Officer

Under DPDP s.13:

• Email: komalsrinivasan.l@gmail.com
• Location: Hyderabad, Telangana, India (postal address on written request)
• Response SLA: acknowledgement within 72 hours; resolution within 30 days.

If unsatisfied, you may approach the Data Protection Board of India under DPDP s.27. For GDPR matters, your local supervisory authority.

9. Withdrawing consent

Reply unsubscribe to any email from Loop, or email the Operator directly. Withdrawal does not affect processing done before withdrawal.

10. Children's data

Loop is not directed at children. Under DPDP s.9 personal data of a child (under 18) is not knowingly processed without verifiable parental consent. If you believe a child's data is held, email the Operator and it will be deleted.

11. Automated decision-making

The waitlist does not run any automated decision-making, profiling, or scoring that produces legal or similarly significant effects on you. When Loop launches its full product, separate disclosure will be made for any AI feature that processes user content on the user's own behalf.

12. Data breach

If a breach affects your personal data, the Operator will notify you and the Data Protection Board of India as required by DPDP s.8(6).

13. What Loop does not do

• Does not sell personal data.
• Does not share data with advertisers or data brokers.
• Does not run Google Ads, Meta Pixel, LinkedIn Insight Tag, or any tracking pixel.

14. Changes

Material changes will be communicated by email to current waitlist members and the dates above will be updated.