LoopOnyx

Privacy Policy

Last updated 17 October 2026

This policy explains what personal data we collect, why we collect it, and how long we keep it.

  1. Who is responsible

    Tidalux Ltd (company number 17019367, ICO registration ZC091301) is the controller of personal data about your account, your billing, and the security of the service. Our registered office is 132a High Street, Bromsgrove, Worcestershire B61 8ES. For personal data in the material you ask us to process for a business (for example a DMARC report), you are the controller and we are the processor. That split is set out in the Data Processing Addendum.

    The UK GDPR and the Data Protection Act 2018 apply. The Privacy and Electronic Communications Regulations apply to cookies. See the Cookie Policy.

  2. What we collect

    • Account: your name, email address, a hash of your password, and, if you add them, a phone number and notification settings.
    • Billing: the plan you are on, subscription status, prepaid balance, the usage ledger, and a Stripe customer reference. Stripe collects and stores card details. We do not.
    • Service: monitors and the addresses you give us, check results, incidents, Filing Watch company numbers and the public filing data we read, DMARC domains and aggregate reports, and the other watches and signals shown in the app.
    • Delivery: alert text, and logs of email, text, and webhook delivery.
    • Security: login events, session records, and, if you turn it on, the secret used for two-factor authentication.
    • Correspondence: messages you send to our contact addresses.
    • Technical logs: an IP address, the time, and the address requested, kept so we can secure the service. We do not use them for advertising.
    • Quiet, only if you install it on a site you run: daily totals of page paths and referring hostnames. The script does not set a cookie. Those totals do not include an IP address or a query string. The signed-in app does not load the script.
    • AI, only when an AI feature is on: the content needed for that feature, such as a check or a digest.

    DMARC aggregate reports can include sending domains and IP addresses. If you add a company to Filing Watch, we send that company number to Companies House so we can read the public register. Please do not put special category data, such as health data, into LoopOnyx. The service is not built for it.

  3. Why we use it, and the lawful basis

    PurposeLawful basis
    To run your account and provide the service you asked forContract
    To take payment, keep the usage ledger, and handle refundsContract, and legal obligation where a record must be kept
    To secure the service, prevent abuse, and keep login recordsLegitimate interests in keeping the service safe. We balance this against your rights.
    To send service messages and the alerts you have switched onContract
    To meet a legal duty, such as a lawful request or a tax recordLegal obligation

    We do not sell personal data. We do not use it for advertising. AI features are optional and may be off. Customer content is never sent to a free or data-sharing model.

  4. Sub-processors

    We use the following providers. The app is hosted by a provider in the United Kingdom.

    ProviderRole
    StripePayments
    ClickSendText messages
    CloudflareDNS, CDN, and DDoS protection
    Our email providerAccount email and alerts
    OpenRouter, when AI is switched onAI features
    Anthropic, when AI is switched onAI features

  5. International transfers

    Some of those providers process personal data outside the UK. Where a transfer needs a safeguard, we use the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.

  6. How long we keep it

    DataHow long
    Check resultsFor the history period on your plan
    Alerts400 days
    Delivery logs90 days
    Login events180 days
    BackupsEncrypted, and kept as 7 daily, 4 weekly, and 6 monthly copies
    Account and service dataWhile the account exists. After you ask us to delete it, we delete the live copy once a 7-day cooling period has passed, except where the law tells us to keep a record. A backup may still hold a copy until that backup ages out.
    Billing recordsFor as long as the law requires

  7. Your rights

    You can ask for access, correction, erasure, restriction, and a copy you can take with you, and you can object to processing based on legitimate interests. You can also complain to a supervisory authority. Where a right has a limit in the law, that limit applies.

    Export and deletion are self-service. In the app, open Account, then the Privacy page. You can export your data as JSON. You can ask us to delete the account. Deletion runs after a 7-day cooling period. Write to [email protected] during those 7 days if you want to stop it.

  8. Complaints

    You can complain to the Information Commissioner's Office at ico.org.uk. Our ICO registration number is ZC091301. We would like to hear from you first, at [email protected].

  9. Contact

    Tidalux Ltd, The Grange, Grange Road, Great Malvern, Worcestershire WR14 3HA (registered office 132a High Street, Bromsgrove, Worcestershire B61 8ES). Email [email protected] for privacy questions, and [email protected] for help with the account.