Privacy policy

Draft for review · revised 29 September 2026.

This is a working draft written to match what the software actually stores. It has not yet been reviewed by a lawyer, and the date it takes effect has not been set.

Who is responsible

Loudloom is a product operated by Business Brain LLC, a Pennsylvania limited liability company. Business Brain LLC decides what Loudloom collects and why, and is who you ask about it: office@businessbrainllc.net.

What we collect

• If you write to us through the form on this site: your name, email, company, website, the platforms you use, your budget band, what you are trying to get, how often you want to post, the extra work you ticked, how many businesses it covers, whether you have pages to link to, the estimate the form showed you, and your message. Our team is emailed a copy so a person can reply. We do not record your IP address with it.
• If you become a client: your email for sign-in (there are no passwords), the browser and operating system you sign in from (for example “Chrome on Windows”, not your IP address), your passkey's public key if you add one, your brand profile, the content we draft and publish for you, files you upload, the messages you exchange with us, which portal pages you have opened since something changed on them, your email preferences, and the tracked-link clicks and platform metrics attached to your posts.
• Connected accounts: the access token each platform issues when you authorise us, or the scoped token or app-specific password you create and paste, plus the account's name or handle, and for the newsletter the list of recipient addresses you give us. Never your account password.
• Billing: your plan, its status, the current billing period and when you accepted the terms at checkout. Card details are held by Stripe, our payment processor; we never see them.
• Readers of published posts: when someone clicks a tracked link we record the time, the referring page the browser reports, and a browser family (desktop, mobile, automated or unknown) worked out from the browser's own description of itself, which we then discard. We do not record the reader's IP address, and no cookies are set on readers. Automated fetches are recorded but not counted as readers.
• People who reply to or mention a client on a connected channel: their public handle, what they wrote, and the post they were answering, so the client can see it and we can suggest a reply the client may post themselves.

How we use it

To do the work described in the terms: draft in your voice, publish what was approved, measure what happened, and report it to you. We do not sell personal data, we do not train AI models on your data, and we do not use your data for anything unrelated to your account.

Who else sees it

Service providers we rely on, each under its own terms: Railway (hosting; our server, database and on-volume backups run in its Amsterdam region, as do files uploaded before we began storing uploads with Google), Google (Google Workspace; it stores the files you upload, as described below), Infisical (secret storage for connection tokens), Stripe (payments; it receives your billing email), Resend (email), where off-site backup is enabled an object-storage service holding copies of our database backups, and Anthropic, whose AI model drafts text. Anthropic receives what a draft is written from: your brief, profile, goals and voice, the text of your pages, drafts being checked against those pages, and, for suggested replies, the reply or mention and the post it answers. It never receives your connection tokens or card. Anthropic states that by default it does not use inputs and outputs from its commercial API to train its models. Our link previews and source checks fetch your public pages as any browser would.

Files you upload. They are stored with Google in a shared drive owned by Business Brain LLC, in a folder for your account only; Google receives each file and its name. Our server passes each upload to Google and each download back to you; it does not keep a copy. You do not need a Google account, and you are never given access to our Drive. Files uploaded before we began storing uploads with Google remain on our Railway volume.

What connected platforms receive, and what we read from them

• Connecting. When you authorise us, the platform receives our app's identity and the permissions we ask for, and tells us which account authorised it (an account id and name or handle) along with the token. Some tokens expire and are refreshed, which is another request to that platform.
• Publishing. The text, images and link previews of each post published to that account. On X a post goes out as the post and then a reply beneath it carrying the tracked link. A link preview is built by fetching your own page and uploading its preview image to the platform. The newsletter is sent through your own Resend account to the recipient list you give us.
• Reading. The counts a platform reports for posts we published (likes, reposts, replies and similar) for your report; a check that the connection still works; and, on Bluesky and X, replies and mentions addressed to your account and the posts they answer.
• Your profile. On Bluesky, when you ask us to, we read and change your account's display name, bio, banner and automated-account label.

Every request identifies the account and carries its token, and like any web service the platform sees technical details of the request, such as our server's address. What a platform does with what it receives is governed by its own terms and privacy policy.

Cookies

This site sets no cookies. The client portal sets two, both needed to sign in: a session cookie, and a short-lived one that ties a sign-in link to the browser that asked for it. Neither is used for advertising or tracking.

Security

Sign-in is by single-use email link, bound to the browser that asked for it, with passkeys or an authenticator app as a second factor. Connection tokens are kept in a dedicated secrets vault, separate from our database. Changes to a client's setup, connections, content and billing are written to an audit log that records whether a client, our team or the software made them.

How long we keep it

We have not yet set fixed retention periods. Today: client data is kept for as long as you are a client, and afterwards until you ask us to delete it; enquiries from the form are kept until you ask us to delete them; database backups are taken daily, and the newest fourteen are kept on our hosting volume. On request we delete a client's content, files, messages, clicks and connection tokens. Files in our shared drive are moved to its trash, from which they can be restored for 30 days before Google deletes them permanently. The audit lines that say what was done, and the invoices, are kept, and copies inside backups made before the deletion remain until those backups are removed.

Your choices and requests

You can disconnect any connected account from your portal; that deletes the token we hold for it. To see, correct, export or delete your data, write to office@businessbrainllc.net. If you are in the EU or UK you have the rights the GDPR gives you, including to complain to your supervisory authority.

Contact

Business Brain LLC · office@businessbrainllc.net · +1 (717) 282-1680
Questions about the Loudloom service: hello@loudloom.dev