Privacy Policy

Last updated: 10 October 2026

1. Who we are, and our two roles

3 Loop is a client-communication service for agencies, operated by Innovation With Pixels, 7 Bell Yard, London WC2A 2JR, United Kingdom (“we”). Each agency that signs up gets its own workspace at its own address (for example yourname.3loop.net), and invites its team and its clients into it.

• We are the controller for the account and billing data of the agencies and people who sign up for 3 Loop: names, email addresses, passwords (stored only as a hash), sign-in records and, once paid plans launch, billing details.
• We are a processor for everything an agency puts into its workspace: its clients’ messages, files, WhatsApp and email conversations, projects and tasks. We handle that data only on the agency’s instructions and only to run 3 Loop for it, under our Data Processing Agreement.

If you are a client of an agency that uses 3 Loop, the agency decides what happens to your data. Please contact the agency first; if you write to us, we will pass your request to that workspace’s admins.

We do not sell data, we do not show advertising, and we do not use anyone’s content to train AI models.

2. What we collect

2.1 Account data

• Name, email address (team members) and role in each workspace (admin, manager, employee or client)
• Password hash (bcrypt); clients may use a short “quick password” their agency sets
• An optional profile picture

2.2 Workspace content (processed for the agency)

• Messages in projects, spaces and direct messages, and replies sent through WhatsApp or email
• Files, photos, voice notes and video, and transcripts of voice notes
• Projects, tasks, approvals, time logs, intake-form answers
• For workspaces that connect them: WhatsApp Business and email mailbox credentials (encrypted at rest), and Slack or Discord connections

2.3 Session and device data

• A signed sign-in token: an HTTP-only cookie on the web, the Keychain or Keystore on phones
• Active sessions: IP address and browser/device type, shown to you under Profile → Active sessions, kept until 7 days after the session ends
• Push-notification tokens, deleted when you sign out on that device

2.4 Audit logs

Admin actions and sign-in events are recorded for security, kept for 90 days, then deleted.

2.5 What we do not collect

• No advertising identifiers, no cross-app tracking, no analytics or session-replay tools
• No tracking cookies: one cookie keeps you signed in, nothing else (so there is no cookie banner)
• No location, contacts or calendar access

3. Why we use it

• To run the service: deliver messages, show your projects, keep you signed in (contract)
• To keep it secure: detect suspicious sign-ins, limit abuse, enforce permissions (legitimate interest)
• To send the notifications you have switched on (contract; you can turn them off)
• To bill agencies once paid plans launch, and to meet legal duties (contract, legal obligation)

4. Who processes it for us

A small number of providers help us run 3 Loop. Each sees only what its job needs:

Inside a workspace, what people see is decided by the agency: project messages are visible to that project’s members, and the agency’s admins can see and moderate their workspace. We disclose data to authorities only when legally compelled, and report child-safety matters as set out in our Child Safety Policy.

5. Where it is stored, and international transfers

The application and its database are hosted by Hetzner in Germany. Files are stored with Backblaze B2. Our team works from outside the EU (Pakistan) and reaches the data hosted in the EU only to support and maintain the service. Where data leaves the EU/EEA or the UK — to our team or to a provider listed above — we rely on the European Commission’s standard contractual clauses or another lawful transfer mechanism.

6. Security

• Every workspace is kept separate from every other one
• All traffic uses TLS; passwords are hashed; mailbox and WhatsApp credentials are encrypted at rest
• Sessions can be seen and revoked; rate limits and audit logs protect against abuse

If you think your account has been misused, change your password and revoke your sessions, then email safety@3loop.net.

7. How long we keep it

• Workspace content — for as long as the workspace exists, unless the agency deletes it sooner
• After a workspace is closed — its data is deleted within 30 days; backups containing it roll off within a further 30 days
• Audit logs — 90 days
• Session records — 7 days after the session ends
• Deleted accounts — personal fields are cleared at once; a nameless placeholder stays for up to 90 days so old references still work

8. Your rights

Depending on where you live (for example under the GDPR or the CCPA) you can ask for access to, correction, deletion or a copy of your data, and object to or restrict how it is used. For workspace content, the agency decides: contact it first. For your own account, use the deletion form or email hello@innovationwithpixels.com. You may also complain to your data protection authority.

9. Children

3 Loop is a business tool. Only adults (18+) may sign up an agency, and the service is not meant for anyone under 13. If you believe a child is using it, email safety@3loop.net and we will act at once.

10. Changes

We post changes here with a new date. Material changes are announced in the app or by email to workspace admins before they apply.

11. Contact

Privacy questions: hello@innovationwithpixels.com · Support: support@3loop.net · Safety and law enforcement: safety@3loop.net · Post: Innovation With Pixels, 7 Bell Yard, London WC2A 2JR, United Kingdom