Privacy, written to be read.

01 · What this is, and who we are

Manyloom is a calm AI project workspace. You drop your work in, and an AI operator we call Loomy sorts it into tasks and plans, builds small tools for you, connects your other apps, runs an invoicing layer, and can act on your behalf when you ask it to.

Manyloom is made by BUTENKO ART STUDIO, a studio based in Burnaby, British Columbia, Canada. Here, “we”, “us”, and “Manyloom” mean the same thing. “You” means the person or business using the product.

This policy explains what data we hold, why, who else touches it, and the control you have over it.

02 · What we collect

We collect only what the product needs to work for you.

Account data

• Your name, email, and password (stored hashed, never in plain text).
• Your plan and billing status. Card details go straight to Stripe, and we never see or store them.

The work you put in

• Projects, tasks, notes, and plans you create or that Loomy drafts for you.
• Personal information inside that work, like client names, contacts, invoice figures, and anything else you include.

Content from connected apps

• When you connect Google or Gmail, Notion, Obsidian, or a social account, we read the content you allow so Loomy can work with it.
• We request the narrowest access a feature needs. We do not scrape your whole account.

Usage data

• Basic, privacy-first analytics: which features are used and where errors happen, so we can fix and improve them.
• No ad-tracking, no third-party trackers, no advertising cookies.

03 · How we use it

We use your data to run Manyloom and to let Loomy do the work you ask of it:

• To sort your work into tasks and plans, build tools, and connect your apps.
• To let Loomy draft, organise, and propose actions on your behalf.
• To run the invoicing and money layer you set up.
• To bill your subscription, support you, and keep the service secure and reliable.

We do not sell your data. We do not use it for advertising. We don’t share it except with the sub-processors named below, all of whom act only to run the service for you.

04 · AI and your data

Loomy is powered by our AI system. This is the part people worry about, so we keep it simple.

• We do not train AI models on your data. Your work is not used to teach any model, ours or anyone else’s.
• We use no-retention AI providers. When your content is sent for processing, it is used to produce your result and then dropped. Not kept, not stored.
• Where we can, we redact personal details before content reaches the model.
• Content you mark Sensitive never goes to a third-party model. It’s processed only by a local model on our own servers (Private), or left untouched by any AI (Sealed). Your choice, per item or project.

Loomy serves you. It does not learn from you, and it does not carry your work into anyone else’s account.

05 · Connected apps and permissions

• Connections use OAuth, the standard way to link apps without sharing your password.
• We ask for least-privilege scopes: the smallest permission a feature needs, and no more.
• You can see every connection you’ve granted from your settings, and revoke any of them in one click, and Loomy loses access immediately.
• Your access tokens are held in an encrypted secrets vault, never in plain text.

06 · Who else touches your data

To run Manyloom we rely on a short list of trusted sub-processors. Each handles a specific job and nothing more.

• Stripe for payments. Your card data goes directly to Stripe, and we never store or see it.
• Our hosting, the servers that run Manyloom, operated by us on infrastructure we control.
• Our AI provider, which powers Loomy under a no-retention, no-training agreement.

If this list changes in a way that affects you, we’ll update this page.

07 · Where your data lives

Manyloom is hosted on our own servers in Canada. Your primary data stays in Canada, encrypted in transit and at rest.

When your content is processed by our AI provider to produce a result, that step may happen outside Canada under a no-retention agreement. Nothing from it is kept.

08 · Your data is yours

Under Canadian privacy law (PIPEDA) and the GDPR, you have clear rights over your data. We build them in rather than making you ask.

Export

You can export your work at any time, in open formats. No lock-in. Your data leaves in a form you can read and reuse.

Retention while active

While your account is active we keep your data so the product can work. Finished work isn’t quietly cleared. It moves into your Archive and is kept whole. Retention runs on a rolling 12 months from your last payment; every payment resets the clock.

Export-then-delete

When work is removed, either on your request or 12 months after your last payment, we first package a complete copy and email it to the account owner. Only then is the work removed, and it sits in a 30-day recoverable trash before the permanent purge. This is also how we honour a right-to-erasure request under the GDPR and PIPEDA.

When a subscription ends

Your work stays put when you stop paying. Your account becomes read-only while the retention window runs. You can still see and export everything. Resubscribing resets the 12-month clock and your data continues uninterrupted.

Deletion

You can delete your account whenever you want. We keep a 30-day grace window; after that, deletion is permanent and revokes all OAuth tokens to your connected apps. To request deletion, write to billing@manyloom.com.

09 · Cookies and analytics

• Manyloom is privacy-first and cookieless for analytics. No advertising cookies, no third-party trackers.
• Our analytics count usage in aggregate; they don’t follow you across the web.
• We use only the essential cookies needed to keep you signed in and secure.

10 · Children, international users, and changes

Children

Manyloom is for adults and businesses. You must be 16 or older to use it, and we don’t knowingly collect data from anyone under 16.

International users

You can use Manyloom from anywhere. Wherever you are, the rights above apply and your primary data stays in Canada. If you’re in the EU or UK, the GDPR rights described here are honoured.

Changes to this policy

If we change this policy in a way that matters, we’ll update the date above and let you know. We won’t quietly weaken your protections.