How Loomworks Solutions handles your information

What we collect depends on how you interact with us:

We use the information we collect to:

• Deliver the services you bought: process documents, build and support your systems, answer your questions
• Communicate with you about your inquiries, quotes, engagements, and appointments
• Invoice, collect payment, and keep the records tax rules require us to keep
• Keep the site working and fix errors
• Send marketing email only where you asked for it or an anti-spam law allows it; every bulk email has a working opt-out

We do not sell or rent personal information, and we do not share it for other companies' marketing. We share it only:

• With service providers that process it for us (listed under Services That Process Data for Us)
• With our client, where you contact us about work that client engaged us to do; requests about that data go to the client, and we forward them
• When the law requires it or a lawful request compels it
• With a buyer of the business, under confidentiality, with notice before your information moves

We use AI services in our work, and you should know exactly where.

These providers process data for us:

• Hosting and database: this website and its database run on server hardware we operate; Cloudflare provides DNS and content delivery, and Cloudflare R2 stores uploads, attachments and backups.
• Sign-in: Google sign-in (OAuth) handles account authentication; when you use it we receive your name, email address and Google profile.
• AI services: third-party providers that process chat messages and, in an engagement, client documents under their business terms. One of them runs an automated prompt-injection screen that receives a credential-redacted excerpt of a message. We will give you the list of these providers on request.
• Twilio: our business phone line, call menu, voicemail recording, and text-message delivery. Twilio processes this data for us and is also an independent controller for some of its own processing (for example security, abuse prevention and product improvement). Twilio keeps voicemail recordings until they are deleted; text-message records are kept about 13 months by default.
• Speech services: an automated third-party service transcribes voicemail audio into text so we can return your call.
• Resend: sends transactional email such as sign-in links, quotes, invoices, and voicemail notifications. The provider keeps email content about 30 days.
• Stripe: card and ACH payment processing. Stripe processes payment data for us and is also an independent controller for purposes like fraud prevention and compliance; payment data stays inside Stripe under its own terms.
• Google Analytics 4: site analytics, loaded only after you accept cookies.
• Sentry: error reports that help us fix problems; a report can include the page you were on and technical details.
• Rate limiting: some routes limit request rates through Upstash Redis, which stores IP addresses and timestamps used to throttle abuse.
• Scheduling: Cal.com (our consultation booking embeds; bookings you make there are handled under Cal.com's privacy policy) and Calendly (the site chat can offer a scheduling link; when you use it, your name and email are handled under Calendly's privacy policy).

Ask us at any time for the current list of the AI and speech providers behind these entries.

We keep information only as long as we have a use for it or a rule requires it:

• We delete or return client documents and extracts at your written request, and aim to within 30 days after an engagement closes; backup copies age out on the backup schedule.
• Invoices, contracts and tax records: up to 7 years. That is our conservative practice, not an accounting rule; the general tax minimum is shorter.
• Voicemail recordings are kept by our telephony provider until we delete them. We delete them by hand and aim to clear anything older than 90 days, and we delete a specific recording or transcript on request.
• Chat conversations are kept until we delete them; ask us to delete yours.
• Text-message consent and opt-out records: while the messaging relationship is active, plus the period needed to honor do-not-text requests.
• Server and error logs: provider defaults (error reports about 30-90 days).
• Deleted information can persist briefly in backups until the backup rotation removes it, and we may keep what the law or an open dispute requires.

The site keeps a small amount of browser storage and asks before loading analytics.

Browser Do Not Track and Global Privacy Control signals: we do not currently respond to them. No analytics loads before you accept cookies.

Access is limited to the owner and to associates under written confidentiality terms; traffic is encrypted in transit (HTTPS); and the client Odoo credentials we store are encrypted. Secrets live in environment configuration on our server, not in the website code.

If personal information is breached, we follow North Carolina's breach law (N.C. Gen. Stat. Sec. 75-65): people we must notify are told immediately following discovery, with a description of what happened, the data involved, our response, and how to reach us. Where we maintain data on behalf of a client, we notify the client immediately following discovery. Where required, we also notify the North Carolina Attorney General.

Email stephen@loomworks.solutions to use any of these rights. We confirm within 10 business days and answer within 45 days (and will tell you if we need one 45-day extension). Where we hold data only on behalf of a client, we forward your request to that client.

• Ask what we hold about you and get a copy
• Correct information that is wrong
• Ask us to delete information (except records we must keep for tax or legal reasons)
• Opt out of marketing email (every bulk email has a working opt-out link) and of text messages (reply STOP)
• Get data you gave us in a portable format, where we can provide it

Our business line is operated for us by Twilio:

Loomworks Solutions LLC may send text messages to your mobile number in connection with an inquiry you made. This section describes how we handle messaging data.

Our services are for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13.

If you believe a child under 13 gave us information, contact us and we will delete it.

We post any change on this page and update the Last Updated date (2026-09-30 as of this version). We can provide prior versions on request.

If a change materially affects information we already hold, we will notify affected customers by email before it takes effect.