Privacy Policy

This privacy policy explains how Loopa Technologies NZ Limited ("Loopa", "we", "us") collects, uses, shares and protects personal information when you use Loopa Pulse, our web application that helps real estate offices and agents create, schedule and publish social media posts about property news and their own listings.

We handle personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles. If you are in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR also applies; see If you are in the EU, EEA or UK.

This policy covers our website at pulse.loopa.co.nz (the public pages, such as Home, Pricing and Contact Us) and the Loopa Pulse app you use after you sign in.

Information we collect

Account information

When you register or are invited to Loopa Pulse, we collect your name, email address and password (stored only as a secure hash). You can also add a phone number, job title and profile photo. We record when you last signed in. If you sign in with Google or Facebook, we receive your name and email address from that service.

Office and organisation information

Details of the real estate office or organisation you belong to, such as its name, address, phone number, business registration number, logo, brand colour, website and billing email address.

Connected social media accounts

When you connect a Facebook Page, Instagram account, LinkedIn profile or Company Page, X account or TikTok account, we receive and store the account's ID and name (for X and TikTok, your @username; for TikTok, the account's open ID and display name) and the access tokens that let Loopa Pulse publish on your behalf. For X and TikTok, this includes a refresh token that lets Loopa Pulse keep the connection working without you signing in again every few hours (X) or every day (TikTok). We only ask for the permissions needed to publish posts and show you how they performed.

Content you create

Posts, captions, images, templates and schedules you create or approve in Loopa Pulse, and a record of what was published, where and when.

Website and listing information

If you connect your office's website, we collect publicly available information from it, such as property listings, listing photos, agent profiles, and client testimonials (which can include the reviewer's name and rating), so that Loopa Pulse can suggest posts. We also collect publicly available property news articles from news websites.

Post performance

Performance figures for your published posts, provided by Facebook, Instagram, LinkedIn, X and TikTok. These include reach, engagement, and audience breakdowns by age range, gender and location. These figures are aggregated percentages and do not identify individual people. For posts on X, we collect figures such as impressions, likes, replies, reposts, bookmarks and link clicks once a day for the first two weeks after a post is published, then once a week for the following two weeks, and we stop collecting them four weeks after the post was published. For posts on TikTok, we collect views, likes, comments and shares; TikTok only provides these for posts that are publicly visible.

Payment information

Subscriptions are paid through Stripe. Your card details are entered on Stripe's secure checkout and are never received or stored by us. We keep your Stripe customer and subscription references and your subscription status.

Website visits and advertising

If your cookie choice allows it (see Cookies), the Meta Pixel on our website and in Loopa Pulse collects the pages you visit, the actions you take (for example signing up, sending the contact form, starting checkout or subscribing), your browser and device, your IP address, and the identifiers in Meta's cookies. If you are signed in, it also sends Meta your email address, first and last name, your organisation's country, a coded (hashed) version of your Loopa Pulse account ID, your plan and your subscription status (for example free, active or cancelled). See Advertising and the Meta Pixel.

Technical information

Like most web applications, our servers record technical information such as IP address, browser type, pages requested and error details. We use this to keep the service secure and working properly.

How we use your information

• to provide Loopa Pulse, including creating, scheduling and publishing posts to the social accounts you connect;
• to suggest content based on property news and your own listings;
• to show you how your posts are performing;
• to manage your account, your team and your subscription;
• to send you service emails, such as account invitations, password resets and verification codes;
• to keep the service secure, including verifying your identity before posts are published and preventing misuse;
• to fix problems and improve Loopa Pulse;
• to measure our advertising, and to show Loopa Pulse ads on Facebook and Instagram to people who have visited our website or used Loopa Pulse (and not to show sign-up ads to existing customers), in line with your cookie choice; and
• to meet our legal obligations.

We do not sell your personal information. We use it for advertising only as described in Advertising and the Meta Pixel. We never use your posts, connected social accounts, access tokens, listings, website content or post performance for advertising.

Advertising and the Meta Pixel

We use the Meta Pixel, a tool from Meta Platforms (Facebook and Instagram), on our website and in Loopa Pulse. It tells Meta which pages were visited and which actions were taken, so that we can:

• measure how well our Facebook and Instagram ads work;
• show Loopa Pulse ads to people who visited our website but have not signed up, to people who have used Loopa Pulse but no longer have a subscription, and to subscribers who have not used Loopa Pulse for some time; and
• find people on Facebook and Instagram who are similar to our customers.

When you are signed in, the pixel also sends the account details listed under Website visits and advertising. Meta's pixel converts your email address, name and country into a coded (hashed) form in your browser before sending them, and Meta uses them only to match the visit to a Facebook or Instagram account. We never send passwords, payment details, access tokens or the content of your posts.

Your first subscription payment. When the first payment for a subscription goes through, which after a free month happens while you are not using Loopa Pulse, our server tells Meta directly through Meta's Conversions API. It sends that it was a purchase, the amount, currency and plan, and your email address, first and last name, your organisation's country and the coded account ID, all in coded (hashed) form. We send this only when your cookie choice would allow the Meta Pixel: never if you rejected advertising cookies, and, if you are in the EU, EEA, UK or Switzerland, only if you accepted them. We do not send your card details or later renewals.

Your choice. If you are in the EU, EEA, UK or Switzerland, the Meta Pixel does not load unless you select Accept. Elsewhere, it is on unless you opt out; if your browser sends a Global Privacy Control signal, we treat that as an opt-out. We work out which applies from your browser's time zone and, when you are signed in, your organisation's country. If we cannot tell, we ask you first. When you register, you can accept with an optional tick box, which is not ticked unless you tick it; registering does not by itself count as consent. If you have an account, we save your choice with it, so that you are asked once rather than in every browser, and we do not show the opt-out notice after you sign in if you are outside the EU, EEA, UK and Switzerland. You can change your choice at any time with Cookie settings at the bottom of every page. If you withdraw consent, we stop the pixel and remove Meta's cookies from our site.

For the collection and sending of this information to Meta, we and Meta Platforms Ireland Limited are joint controllers under the GDPR, under Meta's Controller Addendum. Meta is responsible for what it does with the information after it receives it, under its own Privacy Policy. You can control the ads you see on Facebook and Instagram in your Meta ad preferences.

Artificial intelligence

Loopa Pulse uses AI services to rewrite news articles and listing details into social media posts, to classify listings, and to generate images. To do this, the text or images being worked on are sent to our AI providers, Anthropic and OpenAI. We send only the content needed for the task, not your password or payment details. You review suggested posts before they are published.

Who we share information with

We share personal information only as needed to run Loopa Pulse, with:

• Other users in your office or organisation, who can see shared content, posts and connected accounts, according to their role;
• Social media platforms (Meta for Facebook and Instagram, LinkedIn, X and TikTok), when you connect an account and publish posts to it;
• Sign-in providers (Google and Facebook), if you choose to sign in with them;
• Meta, for advertising through the Meta Pixel, in line with your cookie choice (see Advertising and the Meta Pixel);
• Service providers who help us run Loopa Pulse: Microsoft Azure (hosting, database and diagnostics), Stripe (payments), Mailjet (email delivery), ScrapingBee (collecting website content), and Anthropic and OpenAI (AI processing).

Our service providers may only use personal information to provide their services to us. We may also use or disclose personal information:

• where you have consented;
• where we believe it is necessary to prevent or lessen a serious threat to someone's life, health or safety, or to public health or safety;
• where it is required or authorised by law, for example to comply with a court order; or
• where it is necessary to avoid prejudice to the maintenance of the law, or for legal proceedings.

Storing information overseas

Loopa Pulse is hosted on Microsoft Azure in Australia, in its Sydney and Melbourne data centres, so your account and office information is stored there. Some of our other service providers, such as our payment, email and AI providers, process information in other countries, including the United States and Europe. Information collected by the Meta Pixel goes to Meta Platforms Ireland Limited and Meta Platforms, Inc. in the United States. When we send personal information overseas, we take reasonable steps to make sure it is protected in a way that is comparable to the New Zealand Privacy Act 2020 and, where it applies, the GDPR.

Security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access. All connections to Loopa Pulse are encrypted with HTTPS. Access tokens for your connected social accounts are encrypted, using keys held in a separate secure key store. Passwords are stored as secure hashes. Access to our systems is restricted to authorised people, and a verification code is required before posts are published from a new session.

How long we keep information

We keep your information while your account is active and for as long as needed to provide the service, meet our legal and accounting obligations, and resolve disputes. When you disconnect a social account, we withdraw our access to it on that platform and stop using the connection. When information is no longer needed, we delete it or de-identify it. Our ad audiences built from Meta Pixel data include a visit for up to 180 days. Meta keeps pixel data under its own Privacy Policy.

Cookies

We use two kinds of cookies: essential cookies, which Loopa Pulse needs to work, and advertising cookies, which are set only if your cookie choice allows it.

Essential cookies

• Sign-in cookie: keeps you logged in to your account. It lasts up to 14 days and is extended while you keep using Loopa Pulse. Signing out removes it.
• Session cookie: holds short-term information while you use the app, for example while you connect a social account or confirm a post. It expires after 15 minutes of inactivity.
• Sign-in and connection cookies: short-lived cookies used while you sign in with Google or Facebook, or connect Facebook, Instagram, LinkedIn, X or TikTok. They expire within 10 minutes.
• Security cookies: protect forms and sign-ins against forgery and misuse.
• Notification cookie: briefly carries one-off on-screen messages, such as confirmation that a post was scheduled, and is removed once shown.
• Cookie choice cookie (pulse_consent): remembers whether you accepted or rejected advertising cookies, or that you were told about them when you registered, for 6 months, so that we do not ask on every page. If you are signed in, your choice is also saved with your account.

Essential cookies hold random identifiers or encrypted data, not readable personal information. Because Loopa Pulse needs them to work, they cannot be turned off within the app. If you block them in your browser, you will not be able to sign in.

Advertising cookies

• _fbp (Meta Pixel): a random identifier that lets Meta recognise the same browser across visits to our website. It lasts 90 days from your last visit.
• _fbc (Meta Pixel): set when you arrive from a Facebook or Instagram ad, so that Meta can tell the visit came from that ad. It lasts 90 days.

The Meta Pixel also sends information to Meta's own website, where Meta may read cookies it has set if you use Facebook or Instagram in the same browser. You can accept or reject advertising cookies at any time with Cookie settings at the bottom of every page. You can also block or delete cookies in your browser settings.

When you connect or sign in with Google, Facebook, Instagram, LinkedIn, X, TikTok or Stripe, those services may set their own cookies on their own websites, under their own privacy policies.

Accessing, correcting and deleting your information

You can view and update most of your account and office details in Loopa Pulse under Settings, and disconnect social accounts at any time under My Connections.

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it. You can delete your account and personal information yourself under Settings > Delete account; our Data Deletion page explains what is removed. You can also ask us to do it. Email us at support@loopa.co.nz. We will respond within 20 working days. If we cannot meet your request, for example because the law requires us to keep certain records, we will tell you why.

If you signed in with Facebook or connected a Facebook Page or Instagram account, you can also remove Loopa Pulse from your Facebook settings under Apps and Websites, and ask for your data to be deleted there.

If you connected an X account, you can also remove Loopa Pulse's access in X under Settings > Security and account access > Apps and sessions > Connected apps. Posts already published to X stay on X unless you delete them, either in X or from Past Posts in Loopa Pulse.

If you connected a TikTok account, you can also remove Loopa Pulse's access in TikTok under Settings and privacy > Security and permissions > Apps and services permissions. TikTok does not let apps delete posts, so posts already published to TikTok stay there until you delete them in the TikTok app.

If you are in the EU, EEA or UK

If the GDPR or UK GDPR applies to you, Loopa Technologies NZ Limited is the controller of your personal information, and you can contact our Data Protection Officer, Matt Cahill, at dpo [at] loopa [dot] co [dot] nz.

Why we use your information (legal bases)

• Contract: to provide Loopa Pulse to you or your business, manage your account and subscription, and send service emails.
• Legitimate interests: to keep Loopa Pulse secure, prevent misuse, fix problems and improve the service. We have weighed these interests against your rights.
• Consent: for advertising cookies and the Meta Pixel. You can withdraw consent at any time with Cookie settings; this does not affect what was done before you withdrew it.
• Legal obligation: to keep records the law requires, such as tax and accounting records.

Your rights

You have the right to access your personal information, to correct it, to have it deleted, to restrict or object to how we use it (including for direct marketing, at any time), and to receive the information you gave us in a machine-readable format. To use these rights, email our Data Protection Officer at dpo [at] loopa [dot] co [dot] nz. We will respond within one month. You also have the right to complain to the data protection authority in the country where you live or work (in the UK, the Information Commissioner's Office).

International transfers

We are based in New Zealand, which the European Commission and the UK recognise as giving adequate protection to personal information. When our service providers or Meta process your information in other countries, such as the United States, we rely on the EU-U.S. Data Privacy Framework (and its UK extension) where the recipient is certified under it, or on the European Commission's standard contractual clauses.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

Children

Loopa Pulse is a business service for real estate professionals. It is not intended for children, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this privacy policy from time to time. We will post the updated policy on this page and change the "Last updated" date. If we make significant changes, we will let you know through Loopa Pulse or by email.

Contact us and complaints

If you have a question or concern about this privacy policy or how we handle your personal information, please contact our Privacy Officer and Data Protection Officer:

Matt Cahill, Privacy Officer and Data Protection Officer
Loopa Technologies NZ Limited
2/21 The Parade, St Heliers, Auckland 1071
dpo [at] loopa [dot] co [dot] nz

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner at www.privacy.org.nz.