Privacy Policy

This summary provides key points from our Privacy Notice. You can find more detail in the section referenced after each point.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. See section 1.

Do we process any sensitive personal information? Some information may be considered “special” or “sensitive” in certain jurisdictions, for example racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

Do we identify visitors to our website? Yes. With your consent, we use a third-party identity resolution service that can associate a visit to harloop.com with business contact information, including a name, employer, and work email address. This runs only where you have consented, and you can withdraw consent at any time. See section 5.

Do we collect information from third parties? Yes. Our identity resolution and advertising partners provide us with information about visitors to our website, as described in section 5.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. See section 2.

What are your rights? Depending on where you are located, applicable privacy law may give you rights regarding your personal information, including the right to opt out of the sale or sharing of it. See sections 11 and 13.

How do you exercise your rights? The easiest way is to use our data subject access request form, to visit our Do Not Sell or Share page, or to contact us.

In Short: We collect personal information that you provide to us, and some information automatically when you visit.

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us. The personal information we collect may include: email addresses, names, phone numbers, passwords, and company information (such as company name and website).

Sensitive information. We do not process sensitive information.

Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with it. All payment data is handled and stored by Stripe. You may find their privacy notice at stripe.com/privacy.

Social media login data. We may provide you with the option to register using your existing social media account details. If you choose to register in this way, we will collect certain profile information from that provider, as described in section 6.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to it.

Information automatically collected.Some information — such as your Internet Protocol (IP) address and browser and device characteristics — is collected automatically when you visit our Services. On its own this information does not reveal your specific identity, but it may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. It is primarily needed to maintain the security and operation of our Services, and for internal analytics and reporting. Section 5 describes how this information may be combined with information from third parties to identify you.

The information we collect automatically includes:

• Log and usage data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services, which may include your IP address, device information, browser type and settings, information about your activity in the Services (such as date/time stamps, pages and files viewed, and actions you take), and device event information such as system activity and error reports.
• Device data. Information about the computer, phone, tablet, or other device you use to access the Services, which may include your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location data.Information about your device’s location, which can be either precise or imprecise, derived from your IP address. You can opt out of allowing us to collect this information by refusing access to it or by disabling the location setting on your device. If you choose to opt out, you may not be able to use certain aspects of the Services.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services. Harloop operates an internal software client that uses YouTube API Services to manage and verify videos we upload to our own YouTube channel. By interacting with videos we host on YouTube (for example, by following a link we share), you are also subject to the YouTube Terms of Service. Our use of information received from YouTube API Services adheres to the Google Privacy Policy. The client accesses only our own channel’s data: the list of videos we have uploaded and each video’s title, privacy status, and processing status. We store, in our internal records, the YouTube video ID and upload timestamp of each video we produce, for as long as the related business relationship is active. The client does not access, collect, or store any data about YouTube users, viewers, comments, or any third-party channel, and it does not use cookies or serve advertising. Stored authorization credentials can be revoked at any time at security.google.com/settings/security/permissions, and you may contact us to ask that stored video records be deleted.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries and offer support to users.
• To send administrative information to you, such as details about our products and services and changes to our terms and policies.
• To fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• To request feedback.
• To send you marketing and promotional communications, in accordance with your marketing preferences. You can opt out at any time; see section 11.
• To protect our Services, including fraud monitoring and prevention.
• To identify usage trends so we can improve the Services.
• To determine the effectiveness of our marketing and promotional campaigns.
• To save or protect an individual’s vital interest, such as to prevent harm.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK, the General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent. We may process your information if you have given us permission to use it for a specific purpose. You can withdraw your consent at any time, including by using the cookie preferences control on this site.
• Performance of a contract. Where processing is necessary to fulfill our contractual obligations to you, including at your request prior to entering into a contract.
• Legitimate interests.Where reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms — for example to send information about offers, analyze how our Services are used, support our marketing activities, and diagnose problems or prevent fraudulent activity.
• Legal obligations. Where necessary for compliance with our legal obligations, such as cooperating with a law enforcement body or regulatory agency, or exercising or defending our legal rights.
• Vital interests. Where necessary to protect your vital interests or those of a third party.

If you are located in Canada, we may process your information if you have given us specific permission (express consent) or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases we may be legally permitted to process your information without consent, including where collection is clearly in the interests of an individual and consent cannot be obtained in a timely way; for investigations and fraud detection and prevention; for business transactions provided certain conditions are met; where the information is contained in a witness statement and collection is necessary to assess, process, or settle an insurance claim; for identifying injured, ill, or deceased persons and communicating with next of kin; where we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse; where it is reasonable to expect that collection and use with consent would compromise the availability or accuracy of the information and collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province; where disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records; where it was produced by an individual in the course of their employment, business, or profession and collection is consistent with the purposes for which it was produced; where collection is solely for journalistic, artistic, or literary purposes; or where the information is publicly available and is specified by the regulations. We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

In Short: We may share information in specific situations described in this section and with the categories of third parties listed below.

Vendors, consultants, and other third-party service providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with these third parties designed to help safeguard your personal information.

The categories of third parties we may share personal information with are:

• Ad Networks
• Communication & Collaboration Tools
• Data Analytics Services
• Data Storage Service Providers
• Identity Resolution and Lead Intelligence Providers
• Payment Processors
• User Account Registration & Authentication Services
• Website Hosting Service Providers

We may also need to share your personal information in the following situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

In Short: We may use cookies and other tracking technologies to collect and store your information, and with your consent to identify business visitors to our website.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements or to tailor advertisements to your interests.

Specific information about each cookie we use, how long it lasts, and how you can refuse it is set out in our Cookie Notice.

Visitor identification and identity resolution

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting app.retention.com/optout.

In practice this means that, where you have consented, a third-party identity resolution provider may tell us the name, job title, employer, work email address, and company details associated with your visit. This service operates only on visitors located in the United States. You can withdraw your consent at any time from our Do Not Sell or Share My Personal Information page, which also clears the identifiers already stored in your browser.

To the extent these online tracking technologies are deemed to be a “sale” or “sharing” (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of them using the page linked above, by using a Global Privacy Control signal (see section 12), or by submitting a request as described in section 13.

Google Analytics

We may share your information with Google Analytics to track and analyze the use of the Services. We use Google Consent Mode, which means Google’s tags respect the choice you make in our cookie banner. To opt out of being tracked by Google Analytics across all websites, visit tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services may offer you the ability to register and log in using your third-party social media account details. Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the provider, but will often include your name, email address, and profile picture, as well as other information you choose to make public on that platform.

We will use the information we receive only for the purposes described in this Privacy Notice or otherwise made clear to you on the relevant Services. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice.

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. Regardless of your location, your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we share your personal information (see section 4), including facilities in the United States and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not necessarily have data protection laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

European Commission’s Standard Contractual Clauses. We have implemented measures to protect your personal information, including by using the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies and between us and our third-party providers. These clauses require all recipients to protect all personal information that they process originating from the EEA or UK in accordance with European data protection laws and regulations. Our Standard Contractual Clauses can be provided upon request.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us. Analytics and geolocation data are retained for up to 14 months. Cookie lifetimes are listed individually in our Cookie Notice.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In Short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction, or that you are the parent or guardian of such a minor and consent to that minor’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at team@harloop.com.

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us using the details in section 15.

We will consider and act upon any request in accordance with applicable data protection laws.

Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw it at any time. For cookies and tracking technologies you can do this directly from our Do Not Sell or Share page. For anything else, contact us using the details in section 15. Withdrawal will not affect the lawfulness of the processing before its withdrawal, nor, where applicable law allows, the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications. You can unsubscribe at any time by clicking the unsubscribe link in the emails we send, or by contacting us. You will then be removed from the marketing lists. We may still communicate with you to send service-related messages necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account information. If you would at any time like to review or change the information in your account or terminate your account, contact us using the information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.

Cookies and similar technologies. Most web browsers are set to accept cookies by default. You can usually set your browser to remove or reject cookies, which could affect certain features of our Services. You can also change your choices on this site at any time from our Cookie Notice page.

Complaints (UK). If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us by email at team@harloop.comor by post (see section 15). This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018. We will acknowledge your complaint within 30 days of receiving it, investigate without unjustifiable or excessive delay, and keep you informed of progress and the outcome. If you are not happy with our final response, you can refer your complaint to the Information Commissioner’s Office, the UK supervisory authority: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If you have questions or comments about your privacy rights, you may email us at team@harloop.com.

Global Privacy Control (GPC). We honor the Global Privacy Control signal. If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising. When we detect it, analytics and advertising technologies, including the visitor identification described in section 5, are disabled automatically for that browser and no consent banner is shown. You do not need to take any further action.

You can check whether we are currently detecting a GPC signal from your browser on our Do Not Sell or Share My Personal Information page.

Do-Not-Track (DNT). Most web browsers and some mobile operating systems and applications include a Do-Not-Track feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and for that reason we do not respond to DNT browser signals. We respond to Global Privacy Control instead, as described above. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. It includes illustrative examples of each category. For a comprehensive inventory of all personal information we process, please refer to section 1.

We may also collect other personal information outside of these categories where you interact with us in person, online, or by phone or mail in the context of receiving help through our customer support channels, participating in customer surveys or contests, and facilitating the delivery of our Services and responding to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for: Category A, B, D, H, and I — as long as the user has an account with us; Category F and G — up to 14 months.

Sources of personal information

We collect personal information directly from you, automatically from your device as described in section 1, and from our identity resolution and advertising partners as described in section 5.

How we use and share personal information

We collect and share your personal information through beacons, pixels, and tags. We may disclose your personal information to our service providers pursuant to a written contract between us and each service provider; see section 4.

We may use your personal information for our own business purposes, such as undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information.

Sale and sharing.We do not sell personal information in exchange for money. However, our use of the visitor identification and advertising technologies described in section 5 may constitute a “sale” or “sharing” of personal information for cross-context behavioral advertising as those terms are broadly defined under California and other US state privacy laws. In the preceding twelve (12) months we have shared the following categories of personal information for these purposes: Category A (identifiers), Category F (internet or other electronic network activity), and Category I (professional or employment-related information). You have the right to opt out at any time from our Do Not Sell or Share My Personal Information page, or by sending a Global Privacy Control signal.

We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months: Category A (identifiers), Category B (California Customer Records law), Category D (commercial information), Category F (internet or other electronic network activity), Category G (geolocation data), and Category I (professional or employment-related information). The categories of third parties to whom we disclosed personal information can be found in section 4. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (including under the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (including under the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (including under the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (including under the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (including under the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (including under the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (including under the privacy law in Florida)

How to exercise your rights

To opt out of the sale or sharing of your personal information and of targeted advertising, use our Do Not Sell or Share My Personal Information page or send a Global Privacy Control signal; neither requires you to verify your identity.

To exercise your other rights, submit a data subject access request, email us at team@harloop.com, or use the contact details in section 15.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof of valid authorization to act on your behalf.

Request verification. Upon receiving your request, we will need to verify your identity to determine that you are the same person about whom we have information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from the information already maintained by us, we may request additional information for the purposes of verifying your identity and for security or fraud prevention. If you submit the request through an authorized agent, we may need to collect additional information to verify your identity, and the agent will need to provide written and signed permission from you.

Appeals. Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at team@harloop.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” law. California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit it in writing using the contact details in section 15.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated effective date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently.

If you have questions or comments about this notice, you may email us at team@harloop.com or contact us by post at:

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please submit a data subject access request.