Privacy Policy – Loomic (Pty) Ltd

Effective Date: October 25, 2025

Loomic (Pty) Ltd ("Loomic", "we", "us", or "our") values your privacy. This Privacy Policy explains how we collect, use, share, and protect information through the Loomic App and the Loomic website at www.loomic.co.za.

This Policy applies to all users, including children and their parents or guardians, and is designed to comply with POPIA (South Africa), GDPR (EU/UK), and COPPA (US).

1. Business & App Basics

About Loomic: Loomic is an AI-powered reading app designed for children and readers of all ages. It generates interactive stories, reads them aloud, and allows users to click on words to hear them pronounced, creating an engaging and educational reading experience.

2. Data Collection

A. User Account Information

  • Accounts are required to use Loomic.
  • Information collected: email address and password (encrypted).
  • Parental controls are required for child profiles.

B. Device & Technical Data

  • Collected via Google services: device type, app version, operating system, crash logs, and usage analytics.
  • No precise location data or IP addresses are collected for profiling.

C. Reading & Usage Data

  • Tracks story selections, clicked words, reading progress, and engagement events.
  • Stored under user profiles with encrypted passwords.

D. AI Interaction Data

  • Text inputs for AI-generated stories are transmitted securely to external AI services.
  • No personal identifiers included; data processed in real time.

E. Audio, Camera, or Image Data

  • Microphone used only to read stories aloud; audio is processed in real time and not stored.
  • No camera features are used.

F. Payment & Subscription Data

  • Payments handled via Google Play and Apple App Store.
  • Loomic does not store billing details; only receives confirmation of successful transactions.

G. Website Analytics & Cookies

  • The website currently does not use cookies or tracking tools.

3. Purpose of Data Use

Data is used to:

  • Create and manage user accounts and parental controls
  • Track reading progress and personalise learning experiences
  • Generate and read AI-powered stories
  • Analyse app usage and improve features
  • Provide customer support and necessary service updates
  • Comply with laws and protect against fraud

No personal data is sold or shared for advertising.

4. Data Sharing (Service Providers) ⚠️ Revised for Confidentiality

A. Service Providers

Google Services: We utilize services provided by the corporate entity Google (including their cloud and analytics platforms) for essential functions like:

  • Hosting, Authentication, and Technical Services: Handling account logins, managing our application backend, crash reporting, and general usage analytics.
  • AI Image Generation: Generating story images based on user preferences.

AI Text Processing Services: We use an external Artificial Intelligence provider for AI-generated story processing (text only). This provider processes the non-personal text input you provide to generate stories in real time.

Data is shared with these Service Providers only for the functional purposes described; it is not stored, profiled, or used by them for marketing purposes outside of our direct service.

B. Payment Processors

  • Payments are securely handled via Google Play and Apple App Store.
  • Loomic receives only transaction confirmation.

C. Legal & Compliance

  • Disclosures only as required by law or to enforce our Terms of Service.

D. No Sale or Advertising Use

  • No sale, rent, or trading of personal data.
  • No targeted advertising.

5. Data Storage & Security (Enhanced Retention Clarity)

  • Data stored on Google servers (including Firebase) in South Africa.
  • Security measures include: Encrypted passwords, HTTPS/TLS, limited staff access, Firebase Security Rules, and regular security updates.
  • Data Retention: Personal data is retained only for the duration that your account is active and necessary to provide the service. Upon account deletion, all personal data is removed immediately, except where legally required to be retained (e.g., transaction records) for up to 7 years as per financial regulations.
  • Special protections for children's data (parental consent, no third-party marketing).

6. Children's Privacy (Enhanced COPPA Clarity)

  • Only parents/guardians may create child accounts.
  • Users under 13 (or local equivalent) require parental consent.
  • Verifiable Parental Consent (VPC): We obtain VPC via a small, non-refundable charge to the parent's payment method or a credit card verification during the creation of the child's profile, in line with COPPA requirements.
  • Parents can view reading progress, manage/delete accounts, and withdraw consent.
  • Data used only for personalisation and aggregated analytics.
  • No marketing or profiling of child data.
  • Contact privacy@loomic.co.za for parental requests.

7. International Data Transfers (Enhanced GDPR/POPIA Clarity)

  • User data is primarily processed and stored in South Africa (POPIA).
  • Data transfers may occur outside of South Africa, the EU, or the UK, particularly to the United States (where our AI and technical service providers are based).
  • Safeguards for EU/UK Data: Where data is transferred from the EU/UK to a third country lacking an adequacy decision (like the US), the transfer is secured by implementing Standard Contractual Clauses (SCCs) with our data processors, as required by GDPR/UK GDPR, ensuring adequate protection.
  • We adhere to secure transmission, compliance with Google policies, and all relevant laws, including POPIA, GDPR, and COPPA.

8. Data Subject Rights

Users and parents/guardians may:

  • Access their personal data
  • Correct inaccurate information
  • Delete accounts and data
  • Restrict or object to processing
  • Withdraw consent at any time (via account deletion/subscription cancellation)

Exercise rights by contacting privacy@loomic.co.za

9. Updates to Privacy Policy

  • Loomic may update this Privacy Policy periodically.
  • Changes communicated via the app, website, or email.
  • Continued use after updates constitutes acceptance.
  • Users are encouraged to review the Policy regularly.

10. Contact Information

For privacy questions, concerns, or requests:

Parents/guardians may contact us regarding child accounts, including deletion, consent, and data access requests. Loomic will respond in accordance with POPIA, GDPR, and COPPA.