Privacy notice

MOTIONGRID TECHNOLOGIES LIMITED provides lloopd. In this notice, Motiongrid, we, and us mean that company. lloopd is the workflow product described on this website.

The Constitution of Kenya protects your privacy, including information about your family or private affairs and the privacy of your communications. The Data Protection Act, 2019 gives effect to that right. This notice is the information we give you before we collect personal data, as section 29 of the Act requires.

Section 18 of the Act requires a data controller or data processor to register with the Office of the Data Protection Commissioner when the Commissioner’s thresholds for registration apply.

Two roles matter. If your organisation opens a lloopd workspace, that organisation is the data controller for the personal data in the workspace, and Motiongrid is its data processor. We process that data on the organisation’s instructions. For our own records, including your account, invoices, security logs, and messages you send to us, Motiongrid is the data controller.

This notice applies when personal data is about you. That includes:

• a customer, and the people who administer or use a workspace;
• a person who answers a workflow on the web or through WhatsApp;
• a person who writes to us, books a demo, or visits this website;
• a person whose Meta or Google account is connected to lloopd.

We collect personal data from you when you write to us, book a demo, use a workspace, or submit a workflow. We also receive it from your organisation, from Meta when a WhatsApp message reaches a connected business number, and from Google when a Google account is connected. Where someone else gives us your details, this notice is how you can see what we do with them. Your organisation is responsible for telling you when it asks you to take part in a workflow.

What we collect depends on how you meet lloopd.

• Contact and demo requests: your name, work email, company, country, industry, team size, and the process you describe. The contact form on this website opens an email to us. This website does not store that form itself. If you book a time, the booking window is provided by Calendly, and we receive the booking.
• Accounts: the name, work email, organisation, role, and billing contact of the people who run a workspace, and records of the plan, invoices, and support messages.
• Workflows: the questions, answers, files, phone numbers, and messages that a customer or a participant puts into a workflow, on the web or on WhatsApp, and the audit record of who did what.
• Meta and WhatsApp: the business number a customer connects, and, for a person who messages that number, the phone number, profile name, the message and any media they send, and delivery information WhatsApp provides.
• Google: if a customer connects a Google account, the Google user data shown on Google’s consent screen for that connection. We request only the permissions that feature needs.
• Technical data: log and security records such as IP address, browser type, and timestamps, used to run and protect the service.

Giving us contact details is voluntary. If you do not, we cannot reply to that enquiry. Account details are required to open and run a workspace. If a customer does not provide them, we cannot provide the service. On a workflow, the customer chooses which fields are required. If you leave a required field empty, that step may not submit.

A statute does not compel you to hand this information to us. After we hold it, Kenyan tax and company law can require us to keep some of our own accounting records. We do not ask you for information about your family or private affairs for our own purposes. A customer who puts that information in a workflow has to have a valid reason for requiring it.

We do not ask for sensitive personal data for our own purposes. Sensitive personal data under the Act includes race, health status, ethnic or social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details, sex, and sexual orientation. A customer who collects it through a workflow must have a permitted ground under section 45. Health data has the further limits in section 46.

We use personal data for a stated purpose, and only where section 30 of the Act allows it.

• To answer an enquiry or arrange a demo, as a step you asked for before a contract.
• To provide, secure, and support the workspace a customer has asked for, under that contract. As processor, we follow the customer’s instructions, which are the terms of service, this notice, and the workflows and settings the customer turns on.
• To send invoices and keep tax records, where the law requires it.
• To protect accounts, investigate misuse, and keep the service reliable, on the basis of legitimate interests that do not override your rights. You can object, as section 36 describes.
• To send marketing about lloopd only where you have expressly agreed. You can withdraw that agreement at any time. We do not use a participant’s workflow answers to advertise to that person. Section 37 requires express consent before personal data is used for a commercial purpose, and we anonymise data used that way where we can.

We do not sell personal data. We do not use one customer’s workspace to answer another customer’s questions. Ask lloopd answers from records the person’s role is allowed to see.

We share personal data with the people and services that are part of running lloopd, and when the law requires it.

• The customer organisation, and the users it authorises, for data in its workspace.
• Meta, when WhatsApp or another Meta product is the channel. Meta handles those messages under its own terms.
• Google, when a Google account is connected, for the data on the consent screen and for that connection.
• Calendly, at calendly.com, when you open the booking window and book a demo.
• Providers who host, back up, or send email for lloopd, under instructions to use the data only for that work and to protect it.
• A payment provider, when a customer pays. The provider collects the payment details. We receive a confirmation and what we need for the invoice. We do not claim to store full card numbers.
• Professional advisers bound to confidentiality, and a buyer of the business if one is proposed, for that transaction.
• The Office of the Data Protection Commissioner, the Kenya Revenue Authority, a court, or another authority when Kenyan law requires the disclosure.

Service providers who process personal data for us may do so only on instructions and must protect it. If a provider processes the data outside those instructions, the Act treats that provider as a controller for that processing.

Customers can connect an eligible WhatsApp Business number through Meta’s onboarding. Participants then complete a workflow by messaging that number or by using a web link. WhatsApp is the channel. The record of the workflow sits in the customer’s workspace.

From a WhatsApp conversation we receive the phone number, the profile name, the content and media the person sends, and delivery information WhatsApp makes available. We use this to carry out the workflow the customer configured, to store the submission for the people the customer has authorised, and to keep the connection reliable. We do not sell it. We do not use WhatsApp conversation data to advertise to those people.

If you or your organisation connects Facebook, Instagram, or another Meta product, we receive the information agreed on the Meta consent screen and use it only to provide that connection.

You can remove an app in your Facebook settings under Apps and Websites, and you can stop messages from a business in WhatsApp. Removing the app on Meta’s side does not always delete the copy held in a customer’s workspace. Use the steps under “Delete your information” and we will deal with the copy we hold.

This website does not ask you to sign in with Google. If a workspace connects a Google account, lloopd receives only the Google user data shown on the Google consent screen for the feature the customer turns on. We use it to provide that feature to the customer who connected it, to secure the service, and to comply with the law.

We do not sell Google user data. We do not use it for advertising, for credit, or for employment decisions. We do not use it to train general models. People at Motiongrid do not read it unless you ask us to for support, we need to for security, the law requires it, or the data is aggregated so that it no longer identifies you and is used for internal operations.

lloopd’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

You can revoke access in your Google Account permissions (opens in a new tab). Revoking access stops new collection. Ask us to delete Google user data we still hold, using the steps below.

lloopd is operated with service providers, including messaging and hosting providers, that may store or process personal data outside Kenya. We transfer personal data out of Kenya only where section 48 of the Data Protection Act allows it: where appropriate safeguards are in place, including a jurisdiction with comparable protection, or where another condition in that section applies, such as a contract with you, a contract in your interest, a legal claim, or a legitimate interest that your rights do not override.

Sensitive personal data is transferred out of Kenya only with the data subject’s consent and with appropriate safeguards, as section 49 requires. A customer that asks us to process sensitive personal data must have that consent and must tell the person about the transfer.

Section 39 of the Act says we keep personal data only as long as the purpose requires, unless the law, a legal claim, or you authorise a longer period. We then delete, erase, or anonymise it.

• Enquiry and demo correspondence: until the enquiry is closed, and for up to two years after the last message.
• Account, invoice, and tax records: for the life of the account, and then for at least five years where the Tax Procedures Act requires us to keep records.
• Workspace and workflow data: for the customer’s subscription. After the account closes, we delete or anonymise it within 90 days, unless the law requires us to keep it or the customer has asked for a different period in an order. Copies in backups are overwritten on the ordinary backup cycle.
• Security logs: for up to 12 months, unless we need a particular record for a security incident or a legal claim.
• Google user data and Meta connection data: for as long as the connection is in place, and then deleted with the workspace data, or sooner if you ask and we are allowed to delete it.

We protect personal data with technical and organisational measures suited to the data and the risk, as sections 41 and 42 of the Act require:

• encryption in transit and at rest;
• a separate workspace for each organisation;
• role-based access, so a person sees the records their role allows;
• access by our staff only where it is needed to provide, support, or protect the service.

We have not obtained ISO 27001 or SOC 2, and we do not claim those certifications. More detail is on the security page, and further operational detail will be published there as it is documented.

If personal data is accessed by someone who is not allowed to see it and there is a real risk of harm, we notify the Data Commissioner within 72 hours of becoming aware of it, as section 43 requires, and we write to the affected person unless the Act says we need not. Where we are the processor, we notify the customer without delay, and where we reasonably can, within 48 hours.

Under the Data Protection Act you have the right:

• to be told how your personal data is used (section 26);
• to access personal data we hold about you (section 26);
• to object to processing, unless we show a compelling legitimate interest or the data is needed for a legal claim (section 36);
• to have false, misleading, outdated, or incomplete data corrected (sections 26 and 40);
• to have data deleted when we are no longer allowed to keep it, or when it is irrelevant, excessive, or was obtained unlawfully (sections 26 and 40);
• to ask us to restrict processing in the cases section 34 lists, including while we check accuracy you have contested;
• to receive personal data you provided in a structured, commonly used, machine-readable format, and to have it transmitted where that is technically possible. We respond within 30 days. A complex request may take longer, in consultation with the Data Commissioner, as section 38 allows. This right does not apply where it would harm another person’s rights;
• to withdraw consent at any time, where consent is the basis. Withdrawal does not undo processing that was already lawful (section 32);
• not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects you (section 35).

A parent or guardian exercises these rights for a child. A person you authorise, or a guardian, may exercise them where section 27 applies.

Write to info@lloopd.com. We may ask for enough information to find the record and to check that we are writing to the right person. We respond within 30 days. If we are the processor and your organisation is the controller, we pass the request to that organisation and we tell you. Where we have shared the data with a service provider, we take reasonable steps to pass on a correction or deletion, as section 40 requires.

There is no fee for a request, except the reasonable cost the Act allows for a portability request.

lloopd is for businesses. We do not knowingly offer accounts to anyone under 18. A customer must not collect a child’s personal data unless a parent or guardian has consented and the processing protects and advances the child’s best interests, with a way to check age and consent that fits the risk, as section 33 requires.

If you believe we hold a child’s data without that basis, write to info@lloopd.com and we will delete it.

Motiongrid does not, on its own, make a decision that has a legal effect on you, or that significantly affects you, based solely on automated processing. AI Studio produces a draft workflow a person can edit before it is used. Ask lloopd answers from records the user’s role may see. A person decides whether to rely on the answer.

A customer might build a workflow that approves, refuses, or scores something that matters to a person, such as a job application or a disciplinary step. That customer must give the person the notice section 35 requires and, when the person asks, a review by a human. We may suspend a workflow that is being used to avoid that duty.

You can ask us to delete personal data we hold about you. You do not need an account to ask.

1. Email info@lloopd.com with the subject “Data deletion request”.
2. Tell us the phone number or email we would know you by, and whether you are a customer, a person who answered a workflow, or someone who connected a Meta or Google account.
3. If an employer or another organisation runs the workflow, name that organisation. They control the workspace. We will delete personal data we hold as controller, and we will delete the workspace copy when they instruct us to, or when the Act requires deletion. If they have a lawful reason to keep a record, we will tell you who controls it, where we can do that without exposing someone else’s data.
4. If you connected Facebook, Instagram, or WhatsApp, you can also remove lloopd in your Meta settings. If you connected Google, revoke access under your Google Account permissions. Then send the email above so we delete the copy we still hold.
5. We will write back within 30 days to confirm what we deleted, or what the law requires us to keep, such as an invoice we must retain for tax.

A customer can export workspace data before closing an account. CSV export is available on the plans that include it. Ask us to close the account by emailing info@lloopd.com. We then follow the retention periods above.

Write to us first at info@lloopd.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner under section 56 of the Data Protection Act. The Office is in Kenya and publishes its complaint process at odpc.go.ke (opens in a new tab).

We post changes on this page and change the date at the top. Where a change materially affects a customer’s workspace, we also email the account contact before it applies. The current version is the one on this page.

Data controller, for the records described above: MOTIONGRID TECHNOLOGIES LIMITED, the company that provides lloopd.

Email info@lloopd.com. You can also use the contact page. The terms of service are the contract with customers. Security practices are summarised on the security page.