Privacy Policy
Last updated: 18 July 2026
How Loomis collects, uses, retains and deletes personal information — for the customers who use the platform and the people assessments are about.
1. Who we are
Loomis operates the platform available at loomis.co.za. For any privacy matter, contact hello@loomis.co.za.
This policy covers two groups of people: customers (the people who hold Loomis accounts and commission assessments) and assessment subjects (the people an assessment is about).
2. Information we process about customers
When you hold a Loomis account we process your name, email address, organisation details, authentication records, product usage, and payment history. Card details are handled entirely by our payment providers and never reach or are stored on Loomis systems.
3. Information we process about assessment subjects
Where an assessment is about someone who has not connected their own account, it processes only publicly available information — content that is lawfully accessible without logging in, bypassing controls, or misrepresenting who is asking. Loomis never accesses a private account, private messages, or any other source behind authentication to gather this kind of evidence.
Where a subscriber — or, on Loomis Guard, a household member — connects their own account, they authorise Loomis to read that account directly through the platform's own sign-in. That connection returns everything the platform grants except direct messages, which Loomis never reads. This can include content that is not publicly visible, because the account holder has authorised the connection themselves; it is not collected as public information.
Collection of publicly available evidence is bounded by the purpose the customer selects: each purpose defines what kinds of public evidence are appropriate to collect and how they may be weighed. Evidence is stored append-only so that what an assessment concluded can always be traced to what was actually found.
4. Why we process it
We process customer information to operate accounts, take payment and provide support. We process subject information on the instruction of the commissioning customer, for the legitimate purpose they select. Customers are responsible for having a lawful basis for each assessment they commission — including any notice to or consent from the subject that the laws applying to them require.
5. AI processing
Loomis uses AI services to organise collected evidence and to explain findings in plain language. AI never invents evidence, never determines outcomes on its own, and every AI-written explanation references the collected evidence it is based on. Evidence is weighed by a deterministic, rule-based engine.
6. How long we keep it
Assessment data is retained for a period the customer configures, bounded by a platform-wide maximum. When the retention period for an assessment expires it is deleted automatically. Account records are kept for as long as the account exists and as tax and accounting law requires thereafter.
7. Erasure
A subject may request erasure of their information at any time. Erasure hard-deletes the subject's entire assessment record — the evidence, analysis and report — leaving only a minimal audit entry recording that the erasure happened. Customers can also delete assessments themselves at any time before retention expires.
A customer can also close their entire account at any time, from their account settings. Closing your account deletes your assessments, footprint claims, platform connections and any uploaded documents. Your account record itself is deleted outright unless you have billing history Loomis is required to keep for tax or accounting purposes — in that case the record is kept but stripped of identifying information (your login identity and email are cleared) rather than deleted, so the payment record it is attached to can still be retained lawfully. An active subscription must be cancelled before an account can be closed.
8. Who we share it with
We share information only with the service providers needed to run the platform — hosting, authentication, AI processing, payments and analytics — each bound to process it only on our instructions. We never sell personal information, and we never reuse one customer's assessment data for another customer.
Where you connect a social or platform account, that connection is brokered by Bundle Social, a third-party platform-connection provider: it holds the approved app registration for each platform, and your authorisation is granted through its sign-in flow rather than directly with Loomis. Loomis reads your connected account's content through Bundle Social; it does not read your direct messages.
9. Security
Data is encrypted in transit, access is role-restricted, secrets are managed outside the codebase, and every sensitive action is captured in structured audit logs. Evidence records are append-only: nothing can silently rewrite what was collected.
10. Your rights
Under the Protection of Personal Information Act, 2013 (and equivalent laws elsewhere), you may request access to the personal information we hold about you, ask for it to be corrected, object to processing, restrict processing, or request deletion. A person reviews every request by hand; you may also lodge a complaint with the Information Regulator (South Africa).
11. Cookies and analytics
The platform uses essential cookies for sign-in sessions and first-party product analytics to understand how the platform is used. We do not run third-party advertising trackers.
12. Changes to this policy
We may update this policy from time to time; the date above reflects the latest revision. Material changes will be communicated to account holders before they take effect.
13. Contact
Privacy questions and requests: hello@loomis.co.za.