Privacy Policy

1. Overview

Welcome to Loopapa. This Privacy Policy explains how we collect, use, store, and disclose information when you use the Loopapa mobile application, web application, and website (together, the "Service"). We are committed to maintaining high standards of data protection in compliance with the EU General Data Protection Regulation (GDPR) and the Google Play Developer Policies. Our goal is to provide a secure environment for restaurant operations and digital HACCP record-keeping.

The Service is operated by Hometection Technologies MB, a small partnership (mažoji bendrija) registered in the Republic of Lithuania under registration code 306191355, with its registered office at Verkių g. 31B, Vilnius, Lithuania ("Hometection", "we", "us", or "our").

↑ Back to top

2. Who Is Responsible for Your Data

Loopapa is used by businesses to manage their operations and teams. Responsibility for personal data depends on the type of data:

• Where we are the controller. For the personal data of the account holder (the business and the individual who registers and administers the account) and for operating, securing, and improving the Service, Hometection acts as the data controller.
• Where we are the processor. For the personal data that a business enters about its staff and operations (for example, staff names, professional roles, attendance records, and task data), the business itself is the data controller, and Hometection acts as a data processor that processes this data only on the business's instructions. The business is responsible for having a valid legal basis for this processing and for informing its staff about how their data is used.

↑ Back to top

3. Data We Collect and How We Use It

Loopapa collects only the information necessary to provide efficient restaurant operations and HACCP record-keeping services.

Account Information

Name, professional email, and organizational roles. For staff members, professional system emails are auto-generated to protect personal identity. Admins may access staff accounts via impersonation for management purposes; this is always signaled by in-app banners.

Location Data (GPS)

Used to verify "On-Site" attendance during clock-in and clock-out events. Loopapa does not perform continuous background tracking. Location access is requested only to validate the workplace geofence.

Voice and Audio Data

Microphone access is used for AI-driven Wiki, task, and SOP generation. Recordings are processed via secure AI services and are not used for public model training.

Operational and Device Data

Temperature logs, task completion data, and notification tokens, used to ensure real-time delivery of task updates and discussion messages.

Payment Data

When you subscribe to a paid plan, payment is processed by our payment provider (Stripe) or by the relevant app store. We do not store full card details on our servers.

Website and Technical Data

When you visit our website, we may process limited technical data (such as IP address and device/browser information) necessary to deliver and secure the site.

↑ Back to top

4. Legal Bases for Processing (GDPR)

We rely on the following legal bases:

• Performance of a contract — to create and operate your account and provide the Service (account data, tasks, notifications, billing).
• Consent — for device-level permissions such as microphone (voice) and location (GPS); you can withdraw consent at any time in your device settings.
• Legitimate interests — to secure the Service, prevent fraud and misuse, and improve our product, balanced against your rights.
• Legal obligation — to comply with applicable laws, including tax, accounting, and food-safety record-keeping requirements.

Where Hometection acts as a processor for staff and operational data (see Section 2), the legal basis for that processing is determined by the business that operates the workspace.

↑ Back to top

5. Artificial Intelligence (AI) Services

Loopapa uses Google Vertex AI (Gemini) to process voice commands and generate smart documentation. Voice recordings and text inputs are transmitted to secure cloud environments for real-time analysis, including SOP generation and chat translation.

↑ Back to top

6. Data Retention and Security

We implement Firebase Security Rules and server-side validation to ensure that only authorized personnel within your business can access specific data.

Retention: Active tasks are stored in the daily_tasks collection. Upon completion or review, reports are migrated to a dedicated daily_reports archive for long-term audit compliance, as required by applicable Lithuanian food-safety (HACCP) regulations. We retain personal data for the duration of your subscription and for any period required to meet our legal obligations; specific retention periods may also depend on your subscription plan. When data is no longer needed, or upon deletion of your account, it is permanently deleted or anonymized.

↑ Back to top

7. International Data Transfers

Some of our providers (such as Google and Stripe) may process data on servers located outside the European Economic Area (EEA). Where such transfers occur, they are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision, so that your data continues to receive a level of protection consistent with the GDPR.

↑ Back to top

8. Third-Party Services and Sub-processors

To provide our Service, we work with the following providers, each vetted for data-security compliance:

• Google Firebase — data storage and authentication
• Google Cloud (Vertex AI) — AI processing
• Stripe — payment processing

These providers act as our sub-processors and process data only as necessary to provide their services to us.

↑ Back to top

9. Your Rights (GDPR)

Subject to applicable law, you have the right to:

• Access — obtain a copy of your personal data. You can export your operational data (Tasks/Reports) in CSV or PDF format at any time.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data. Admins can trigger a full workspace purge, permanently deleting all Firestore documents, Storage files, and Auth records.
• Restriction and Objection — restrict or object to certain processing.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — withdraw consent for Location or Microphone access at any time through your device settings.
• Lodge a complaint — you have the right to lodge a complaint with the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), or with the data protection authority in your country of residence.

To exercise any of these rights, contact us using the details in Section 13. If your data is managed by a business as the controller (see Section 2), we may direct your request to that business.

↑ Back to top

10. Children's Privacy

The Service is intended for businesses and their staff and is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

↑ Back to top

11. Cookies

Our website may use cookies and similar technologies that are necessary for its operation and security, and, where applicable, to understand site usage. You can manage or disable cookies through your browser settings.

↑ Back to top

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above. Material changes may also be communicated in-app or by email.

↑ Back to top

13. Contact Information

↑ Back to top