Privacy policy
Last updated 23 October 2026
This policy explains what personal data Followloop processes, why, for how long and what your rights are. Followloop is provided by 4J Solutions, obrt za računalno programiranje, vl. Vedran Jandrašinčec, Milana i Naste Rojc 11a, 43000 Bjelovar, Croatia (OIB 27824314046, MB 98647679) ("we", "us"). You can reach us at the contact address published on this website.
1. Two roles
We are the controller for data about the people who visit this website, sign up and use Followloop (account data) and for billing.
We are a processor for the data our customers put into Followloop: their contacts and the emails in the mailboxes they connect. For that data the customer is the controller and we process it only on their instructions, as described in the data processing terms in our terms of service. If you received an email from a Followloop customer and want to exercise your rights, please contact that sender; if you write to us instead, we will pass your request on.
2. What we process
| Data | Examples | Why |
|---|---|---|
| Account data | name, email address, the identifier from your Microsoft or Google sign-in, organization and role, two-step sign-in settings | to give you access and keep your account secure |
| Billing data | plan, subscription status, Stripe customer and subscription identifiers. Card details are handled by Stripe and never reach us. | to charge for the service and meet accounting obligations |
| Customer data | contacts (name, email, phone, address, notes, custom fields), email metadata (sender, recipients, date, subject), the sender's own text of each email up to 2,000 characters, AI summaries and suggested next steps, campaign and activity history | to provide the service the customer uses |
| Mailbox access | IMAP/SMTP passwords and Microsoft sign-in tokens for connected mailboxes, stored encrypted in Azure Key Vault | to read and send email on the customer's behalf |
| Technical and security data | IP address, browser, request logs, errors, an activity log of owner actions | to run, secure and troubleshoot the service |
We do not store email attachments or the quoted history of earlier emails. When you open a full email in Followloop, it is fetched from your mail server for display and not stored.
3. Legal bases
- Performance of a contract (Art. 6(1)(b) GDPR) for account data and providing the service.
- Legal obligation (Art. 6(1)(c)) for invoices and accounting records.
- Legitimate interests (Art. 6(1)(f)) for security, abuse prevention and service improvement based on technical logs.
- Customer data is processed on the customer's instructions (Art. 28 GDPR). The customer is responsible for having a legal basis for emailing their contacts.
4. Artificial intelligence
When AI features are on, the text of an incoming email, a few earlier messages of the same conversation, the contact's name and stage, and the customer's product description are sent to Azure OpenAI in the EU (Sweden) to classify the reply and draft answers. Microsoft does not use this data to train its models. AI never sends an email by itself: drafts are only sent when a user approves them.
5. Who receives data
We use the service providers listed on the subprocessors page, under contracts that require them to protect the data. Data goes to other services (for example HubSpot, Pipedrive, Zapier, Slack or Microsoft Teams) only when a customer connects them. We do not sell personal data and do not use it for advertising.
6. Where data is stored
Followloop runs in Microsoft Azure data centres in the EU: the application, database and key vault in Germany and the AI model in Sweden. Some providers, such as Stripe and Microsoft, may access data from outside the EU; such transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. How long we keep data
- Email text is deleted after the retention period the organization chooses (12 months by default); the date, subject and link to the contact remain.
- The owner activity log is kept for one year. Webhook delivery logs and technical logs are kept for 30 days.
- When a contact is erased, all of their data is deleted and only a one-way hash of the address is kept, so it is not imported again.
- Account and customer data is kept while the organization exists. When an organization is deleted, its data is removed immediately and disappears from automatic database backups within their retention period (currently 7 days).
- Billing records are kept as long as accounting law requires.
8. Cookies and local storage
The website uses no analytics or advertising cookies. The app uses only cookies that are needed for it to work: the sign-in session, protection against cross-site request forgery and your language choice. Your light or dark theme is remembered in your browser's local storage. The app loads the Inter typeface from Google Fonts, which receives your IP address when the font is downloaded.
9. Security
All traffic is encrypted with TLS. The database is encrypted at rest, mailbox passwords and tokens are kept in Azure Key Vault, and every organization's data is separated at the database level. Users can turn on two-step sign-in, and owners can require it.
10. Your rights
You have the right to access, correct, delete, restrict and port your personal data and to object to processing based on legitimate interests. Write to the contact address published on this website. Owners can export or delete all organization data themselves in the app. You can also complain to a supervisory authority; in Croatia that is the Personal Data Protection Agency (AZOP, azop.hr).
Every email sent through Followloop contains an unsubscribe link. Once used, the address is not emailed again by that organization.
11. Children
Followloop is a business service and is not meant for people under 16.
12. Changes
We will post changes on this page and update the date above. If a change materially affects customers, we will tell account owners by email in advance.