Privacy Policy

This privacy policy explains how Simone Devoti, VAT IT01841290339 (“we”, “us”, or “ApproveLoop”) handles personal data when you use the ApproveLoop website, the studio workspace, or a client review link. For studio accounts, billing, the website, and our own product operations, we are the controller. For client and project information a studio uploads, or that people submit through a review link, the studio decides why that information is processed. We process it to provide the Service to that studio.

Account data. When you create a studio account, we store your email address, a password hash or the Google account identifier used to sign in, your email language, your newsletter preference, and the studio organizations you belong to. Studio and project data. Studios enter client names, email addresses, and optional company names. They also upload project materials such as drawings, scope documents, comments, revision rounds, approvals, and change requests. Comments and approvals store the name shown for the person who made them. An approval also stores the IP address, browser user agent, and time of that approval, so the record stays tied to one version. Review links. A person who opens a private review link does not create an ApproveLoop account. We store a review session so they can comment, submit a round, or approve a version. The studio chooses who receives the link. Billing data. Paid plans are billed through Stripe. Stripe processes payment card details, and the billing address and tax identifiers collected at checkout. We receive subscription status, customer and invoice identifiers, and related billing events. We do not store full card numbers. Messages. We send transactional email, such as account confirmation and password reset, to the address on the account. If you opt in to product news, we store that choice and send those messages through our email provider. Technical data. Hosting and telemetry may process IP address, browser type, pages visited, and diagnostic logs. Review tokens, passwords, and email addresses are removed from website and app telemetry URLs before those URLs are stored. In production, product analytics record organization-level events, such as an organization or project identifier and an event name. Those events do not include client names, comments, or drawing content. Feedback. The website and the studio load a feedback widget. If you send a message through it, that provider processes the message and the technical data needed to deliver it.

We use personal data to: • create and secure studio accounts, including Google sign-in and email confirmation; • provide projects, review links, comments, approvals, and change requests; • keep an approval record tied to one specific version; • bill subscriptions and keep billing records; • send service email and, only if you opt in, product news; • protect the Service against abuse, keep it reliable, and understand which product actions studios use; • answer requests you send us. Where we decide the purposes, we rely on contract when processing is needed to provide the Service, on legitimate interests to keep the Service secure and to understand product usage without client drawing content, and on consent for optional product news. You can withdraw that consent in studio account settings or by contacting us. Where the studio decides the purposes, we process the data on the studio’s instructions to provide the Service.

We share personal data with providers that process it for us, and when the law requires disclosure. The providers we use include: • Microsoft Azure, for application hosting, the database, file storage, and technical telemetry (Application Insights); • Stripe, for checkout, the customer portal, and payment processing; • Google, when you choose Google sign-in; • Resend, for transactional email and the newsletter; • PostHog, for organization-level product analytics in production; • Featurebase, for the feedback widget. People who open a review link can see the project materials the studio included in that review. Other members of the same studio can see that studio’s clients, projects, and related records. We do not sell personal data. Some providers process data outside the European Economic Area. Where a transfer requires a safeguard, we use the one the provider offers, such as standard contractual clauses.

We use cookies to run the Service and to remember choices you make: • preferred_locale stores the language you select, for up to one year; • preferred_currency stores USD or EUR when you switch currency, for up to one year; • approveloop.studio keeps you signed in to the studio and is an HttpOnly cookie; • approveloop.csrf helps prevent cross-site request forgery on studio actions; • approveloop.review keeps a client review session on the review host; • approveloop.google is a short-lived cookie used only while Google sign-in completes. Outside local development, authentication and review cookies are marked Secure. The feedback widget and telemetry scripts may set their own cookies when they run. You can control cookies in your browser. Blocking the cookies above can stop sign-in, review, or saved language and currency choices from working.

We keep personal data for as long as the studio account, organization, or project needs it, and for longer when billing, tax, or security records must be kept. You can delete your studio user account in the Service. That deletion removes the user account and signs you out. Organization data, projects, clients, and review records can remain available to other members of the same studio until the organization is closed or that content is removed. Language and currency cookies expire after about one year unless you clear them sooner. Sign-in and review cookies last for the session or the period set for that cookie.

Depending on where you live, you can ask to access, correct, delete, or receive a copy of personal data we hold about you, to restrict or object to certain processing, and to withdraw consent. In the studio account settings you can update your email, password, email language, and newsletter preference, and you can delete your user account. For other requests, email hello@approveloop.app. We may ask you to confirm that the request is yours. You can also complain to a data protection authority. In the European Economic Area, that can be the authority in your country or the Italian Garante per la protezione dei dati personali. The Service is for professional studios and their clients. It is not directed at children, and we do not knowingly create accounts for children.

We may update this policy when the Service or the law changes. The “Last updated” date on this page changes when we do. If a change materially affects how we use personal data, we will give a clearer notice when that is practical.

Questions about this policy or your personal data: hello@approveloop.app. Controller: Simone Devoti, VAT IT01841290339.