1. Who we are
Loopback Inc is a Canadian company based in Mayerthorpe, Alberta. Our primary website is https://www.loopbackinc.com. This product is hosted primarily in Canada (DigitalOcean TOR1). For privacy questions, contact [email protected].
2. What the service does
Organizations (tenants) sync selected Microsoft Entra ID / Azure AD directory contacts into Loopback. Enrolled Android devices pull those organization contacts into a dedicated on-device account labeled Loopback. The admin portal shows sync status and configuration only — it does not browse or export contact names, emails, or phone numbers.
3. Information we process
3.1 Organization (tenant) contact data
When a tenant connects Entra and selects groups, we receive contact fields such as first name, last name, job title, work email, and mobile number, plus directory source identifiers. That data is encrypted at rest with per-tenant keys (envelope encryption) before storage. Blind indexes may be used for matching without exposing plaintext in ordinary database access. Portal and admin APIs are designed so operators cannot list decrypted contact PII.
3.2 Portal administrator accounts
To run the portal we store account email, display name, phone number (for SMS two-factor authentication where required), password hash, role, and WebAuthn / passkey credentials. We also store session records, SMS one-time codes (hashed), and related authentication challenges.
3.3 Devices and enrollment
For enrolled Android devices we store a device label, device identifiers we assign, hashed refresh tokens, sync cursors, optional public key material, a hashed install identifier, contact-wipe request/acknowledgement state, and linkage to the enrolled user contact where applicable. Enrollment and invite flows may process SMS codes and limited phone hints (for example last digits) needed to complete enrollment. A "wipe" in this product means only removing organization contacts that this app synced into the dedicated Loopback contacts account on the device — it is not a full phone wipe, factory reset, or remote erase of other apps, photos, messages, or personal contacts.
3.4 Android app — on-device data
The Loopback Contacts app requests Contacts and related account/sync permissions so it can create and update contacts in a dedicated Loopback account only. Personal, Google, SIM, and other non-Loopback contacts are not modified. Matching personal contacts may be aggregation-linked so the Contacts app shows one person; those other accounts are never edited. The app stores API base URL, device id, access and refresh tokens, and sync metadata in encrypted preferences on the device. Tokens and contact PII are not written to application logs.
3.5 Billing
Subscriptions are billed per connected device through Stripe. We store Stripe customer and subscription identifiers and billing status. Card numbers and payment credentials are handled by Stripe, not stored on Loopback servers.
3.6 Operational records
We keep sync run summaries (counts, status, errors — not contact bodies), audit logs (actions, actor, IP, redacted metadata), invite lifecycle events, tenant branding settings, and Entra connector configuration (tenant/client identifiers and encrypted secrets). Structured logs are intended to avoid plaintext email, phone, or name.
3.7 What we do not collect
The Android app does not include third-party advertising SDKs, analytics beacons, or crash-reporting SDKs in the product as shipped. We do not sell personal information.
4. How we use information
- Provide contact sync to enrolled devices for the tenant that authorized it
- Authenticate portal users and devices; enforce two-factor and enrollment controls
- Operate billing, support tenant configuration, and maintain service security
- Detect abuse, debug failures, and meet legal obligations
- Remove only org contacts synced by this app when membership ends or a contact wipe is requested (never a full-device wipe)
5. Legal bases (where applicable)
Depending on your location, we process data to perform a contract with the customer organization, with consent where required (for example SMS or device permissions), for legitimate interests in securing and operating the service, and to comply with law. Tenant administrators are responsible for having a lawful basis to sync directory contacts to employee or contractor devices.
6. Sharing and processors
We share data only as needed to run the service:
- DigitalOcean — application hosting and managed PostgreSQL in Canada (TOR1)
- Microsoft — Entra ID / Microsoft Graph, when a tenant connects their directory; separately, Graph Mail may send transactional email from Loopback
- Telnyx and/or Twilio — SMS for OTP and enrollment invites (carriers may process message metadata)
- Stripe — payment processing
- Google — distribution of the Android app via Google Play (Google receives standard Play Store and device update data under Google's policies)
We may disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction, subject to appropriate safeguards.
7. Where data is stored
Primary application and database infrastructure are in Canada (DigitalOcean TOR1). Some processors (for example Microsoft Graph when reading a tenant's Entra tenant, SMS providers, Stripe, or Google Play) may process data in other regions according to their services. We do not intentionally copy production database backups to non-Canada regions without a residency review.
8. Retention
Contact ciphertext and device records are retained while the tenant subscription and enrollments remain active, and as needed for contact-wipe or enrollment revocation. Sync runs, audit logs, and invite events are typically purged on a rolling window (default about 90 days, configurable per tenant). Tenant offboarding may use cryptographic shredding (destroying tenant keys) so remaining ciphertext cannot be decrypted. You may delete the Android app and clear the Loopback account data on the device at any time; server-side enrollment may still need an admin revoke or a contact-only wipe of Loopback-synced contacts.
9. Security
We use TLS in transit, per-tenant envelope encryption for contact and sensitive secrets at rest, hashed credentials and session tokens, encrypted on-device preferences for tokens, and role-separated portal access. No method of transmission or storage is perfectly secure; please protect portal credentials and device unlock methods.
10. Your choices and rights
Device users can uninstall the app and remove the Loopback contacts account. Tenant administrators can revoke enrollments, request removal of Loopback-synced org contacts from the device (not a full phone wipe), manage Entra group membership (which controls whose contacts sync), and close accounts through the portal or by contacting us. Depending on applicable law (including Canadian privacy legislation and, where relevant, GDPR/CCPA-style regimes), individuals may request access, correction, deletion, or restriction. Because org contacts are processed for the tenant customer, we may redirect individual requests to that organization's administrator when appropriate. To exercise rights with Loopback directly, email [email protected] or use Account & data deletion.
12. Children
The service is for workplace directory sync. It is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect their personal information.
13. Changes
We may update this policy from time to time. The effective date above will change when we do. Material changes may also be noted in the portal or Play Store listing. Continued use after an update means you accept the revised policy.
14. Contact
Loopback Inc
Mayerthorpe, Alberta, Canada
[email protected]
Company site: https://www.loopbackinc.com
Product: https://loopback.ca