Privacy policy

This policy covers the personal information Loonext handles when a business uses the service to text its customers. It follows Canada's PIPEDA and Quebec's Law 25 and applies in both countries we serve. Two groups of people are involved: the account users on a business's crew, and the contacts those businesses text. The business is the party that decides who to text and why; Loonext processes that data to run the shared inbox on the business's behalf.

We collect only what the service needs to work:

• Account data: your name, email, and the business details you provide to register with the phone companies (legal business name, address, and a business identifier such as an EIN or BN). For the sole-proprietor path we collect the last four digits of an SSN/SIN and a mobile number for a one-time verification code, we never collect or store a full SSN/SIN.
• Contact and message data: the phone numbers, names, notes, and message content that flow through your inbox. This is your business's data; we hold it so your crew can see and reply to it.
• Billing data: handled by Stripe. We store customer and subscription identifiers, not full card numbers.
• Sign-in and device data: for each device signed in to your account we keep which app it is, when it last used the service, and the approximate city the request came from. It is there so you and your workspace owner can see what has access and end it, on the “signed-in devices” screen in Settings. We keep the city, not the IP address, and only for as long as the record is useful (90 days after a device stops being signed in).
• Product analytics: cookieless, event-level usage (page views, feature clicks, counts). We do not put message content, names, addresses, or phone numbers into analytics. Our cookie policy lists every cookie and browser-storage item we use.

To provide the inbox, provision and register your number, send and receive texts, bill your subscription, prevent abuse and fraud, meet our legal and carrier obligations, and answer your support requests. We do not use your message content to train models or to advertise.

Mobile numbers and SMS consent data are never shared with, or sold to, third parties or affiliates for their own marketing. The consent a customer gives to be texted, and the phone number tied to it, stay inside Loonext and the business that collected them. They are used only to deliver that business's messages and to honor opt-outs.

When a business starts a conversation with a new contact, Loonext records that consent was attested, a name and a date. When someone texts STOP, the opt-out is recorded and future sends to that number are blocked.

Loonext processes and stores data in the United States. Our database, authentication, and file storage run on Supabase in the AWS us-east-1 region. If you are in Canada, your data is transferred to and processed in the United States, we state this plainly rather than burying it.

One exception, and we would rather name it than have you find it. AI inference runs on Cloudflare's global network and is not restricted to any one country. Cloudflare's own data-localization compatibility list marks Workers AI as not compatible with Regional Services, the feature that confines processing to a region. So we cannot pin it to Canada or to the United States, and we will not imply otherwise. It applies only to the features in section 7, only to what those features send, and only while the request is being answered. Cloudflare does not store what is sent for inference unless the application writes it to a storage service itself. What comes back, we store in your workspace like any other message data, and delete with it.

The full list of the vendors that process data on our behalf, and the region each operates in, is on our sub-processors page.

Our app is almost certainly on a phone you own rather than one your company issued. So here is what it keeps on the device itself, and what happens to it.

• Your sign-in. Held in the phone's own secure storage (the Keychain on iPhone, app-private storage on Android), so no other app can read it.
• Recent conversations, contacts and unread counts, so the app opens to something rather than a spinner on a weak signal.
• Messages you sent while offline, with any photos attached, until the phone gets signal and they go.

All of it is deleted when your session ends, whether you sign out yourself or an owner signs your phone out from their team settings. Not marked for later: removed, including the photos.

Notifications never contain a message. We leave the words out of the notification itself rather than relying on a phone setting, so nothing a customer wrote can appear on your lock screen for whoever picks the phone up.

You can put a lock on the app, separate from the phone's own lock, in Settings. It is off by default, and worth turning on if a spare phone gets shared around the crew.

Passing the phone to a colleague is one tap in Settings. It signs you out, clears everything above, and leaves them to sign in as themselves so their replies are theirs.

Photos arrive without their location. Phones write the GPS position of wherever a picture was taken into the file itself. We remove it as the photo arrives, on pictures your crew uploads and on pictures your customers text you. A job already has an address; the picture does not need to carry one.

Your phone's address book is never uploaded. If you give the app permission, it shows your own contacts beside the crew's so you do not have to retype a number. That search happens on the phone, and none of it is sent to us.

We share data only with the sub-processors that make the service run, the phone carrier (Telnyx), payments (Stripe), infrastructure (Supabase/AWS, Cloudflare), email (Resend), and error/analytics tooling (Sentry, PostHog), each limited to what its job requires and listed on our sub-processors page. We may disclose data if the law requires it. We do not sell personal information.

Your workspace can also send its own data somewhere. If an owner or admin sets up a connection, we post what happens here, including message text and a contact’s name and number, to the web address they enter, until they delete it. If they create an API key, whoever holds that key can read whatever its permissions allow. In both cases the recipient is chosen by your business rather than by us, and it is not covered by our agreements with the services above.

Push notifications reach phones through Apple, Google, and the browser’s own push service, so those services carry whatever the notification says. By default that is the contact’s name and the first line of their message, which is what lets a crew tell a lead from a “thanks” without unlocking a phone. An owner or admin can turn message text off for the whole workspace in Settings → Notifications; after that the notification carries the name only, and the words are never sent to a push service at all. This is a workspace decision rather than a per-person one, because the content usually belongs to the customer rather than to the person holding the phone.

Three features send content to an AI model: suggested replies, task details, and voicemail transcripts. They all run on Cloudflare Workers AI, inside the same Cloudflare account that already hosts the application. Our sub-processors page names each feature, exactly what it sends, the model that receives it, and whether it is on by default.

Cloudflare’s published Workers AI policy states: “Cloudflare does not use your Customer Content to (1) train any AI models made available on Workers AI or (2) improve any Cloudflare or third-party services.” We do not use message content or voicemail audio to train anything either. What comes back is stored in your workspace like any other message data and is deleted with it.

Some of this content belongs to the people your business texts and calls, not to you or to us. A voicemail is somebody’s voice and a thread is somebody’s words. That is why every one of these features can be switched off for your whole workspace, and why a drafted reply is never sent automatically. A person reads it, edits it, and decides.

We keep account and message data while your subscription is active and for a reasonable period afterward to meet legal, tax, and carrier record-keeping duties, then delete or anonymize it. Opt-out records are kept as long as needed to keep honoring the opt-out.

You do not have to ask us. You can delete your own account, or close a whole workspace, from inside Loonext. See delete your data for exactly what each one removes. Closing a workspace erases everything in it 30 days later, which is a window in which a workspace closed by mistake can still be recovered; after that nobody can undo it. Two things outlive it: do-not-text records, which belong to the person who sent the STOP rather than to the business that received it, and a stripped record that consent existed, which Canadian anti-spam law requires us to hold for three years with names and message contents removed.

The defaults, by kind of data. Texts, conversations, job photos and call records are kept for seven years after the last activity on them, because a contractor in a warranty dispute over a two-year-old job needs those texts, and deleting them sooner would cause the harm the deletion was meant to prevent. Voicemail recordings are the exception and are kept for one year: the transcript keeps what was said, while the recording is somebody’s actual voice in their home and is worth far less after the first few weeks. The transcript itself stays with the call record for the full seven years, which is what makes deleting the audio safe rather than lossy. Audit logs are kept for 12 months. Do-not-text records are kept indefinitely, because they belong to the person who sent the STOP.

If you write to us through the contact form on this site without ever creating an account, we keep your name, email, company and message for up to a year so we can reply and follow up, then delete them. We also record the IP address the form was submitted from, purely to tell a spam flood from a real enquiry, and that is deleted after 30 days, sooner than the rest, because it stops being useful sooner. You can ask us to delete a contact-form submission at any time by emailing privacy@loonext.com, and you do not need an account to do it.

Under PIPEDA and Law 25 you can access, correct, or delete your personal information, and withdraw consent. Deletion is self-serve and takes effect immediately; delete your data has the steps. For anything else, or if you have lost access to your account, email privacy@loonext.com and we'll respond within the timelines the law requires. If a contact of one of our business customers asks us to exercise a right, we'll route the request to that business, which controls the data.

For Quebec residents, Law 25 gives you additional rights, including the right to be informed of the use and disclosure of your information and the right to portability. As required by Law 25, Loonext has a designated person responsible for the protection of personal information: our Privacy Officer, reachable at privacy@loonext.com. We disclose above that personal information is transferred to and processed in the United States, that the features in section 7 send message content or voicemail audio to an AI model on Cloudflare’s global network, and that this inference in particular is not confined to any one country.

Data is encrypted in transit and at rest, each business's data is isolated from every other tenant, and we keep message content out of our analytics and error logs. The details are on our security page.

Questions or requests? Email privacy@loonext.com. If you're in Canada and aren't satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec for Quebec residents.