Privacy policy

Who is responsible

The controller of your data is Malwina Kleszcz, Pogórska Wola 273, 33-152 Pogórska Wola. Contact: e-mail: info@loupa.online.

What we collect

• Account: name, e-mail address and Google account ID, received when you sign in with Google. We do not see or store your Google password.
• Work data you and your studio enter: projects, stages, files and their versions, comments and drawings, messages, logged time, rates and contracts, overheads, invoices and company details.
• Technical data needed to run the service: session cookies, server logs kept by the hosting provider (IP address, time, requested address).

Why and on what basis

• To provide the service you signed up for — Art. 6(1)(b) GDPR (contract).
• To keep the service secure and fix errors — Art. 6(1)(f) GDPR (legitimate interest).
• Invoice and company data you enter are processed for your own accounting; you decide what goes in.

Who else processes the data

• Supabase — database and file storage, servers in Frankfurt (EU).
• Vercel — application hosting and server logs.
• Google — sign-in only (we receive your name and e-mail).
• Sentry — error reports (error message, page address, browser); no names or e-mail addresses.
• We do not sell data, show ads or use analytics or tracking tools.

Who sees what inside Loupa

Your studio's data is visible to members of that studio according to their role: the owner and managers see costs and rates, designers see their own work, and clients see only what was shared with them for review. People with a review link see only the files covered by that link.

Cookies

• loupa_session — keeps you signed in.
• loupa_ws — remembers which studio you are working in.
• loupa_lang — remembers the interface language.
• loupa_pkce, loupa_invite, loupa_guest — used briefly during Google sign-in, when accepting an invitation and when a guest comments through a review link.
• All of them are strictly necessary; there are no marketing or analytics cookies.

How long we keep it

As long as your account exists. When you delete your account (Settings → Danger zone) your account and the studios where you are the only member are removed from the database. If a studio has other members, the app asks you to leave it first, so their work is not deleted with your account. Server logs are kept by the hosting provider for a short period according to its own policy.

During the test phase we may reset demo data; we will not delete your own work without telling you first.

Your rights

You can access, correct, export and delete your data, restrict or object to processing, and lodge a complaint with the supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). To exercise a right, use e-mail: info@loupa.online.

Changes

We will update this policy when the app starts doing something new with data (for example e-mail notifications or payments) and show the date of the change above.