Privacy policy

Who we are

Omnipulse is a product of LoomTech, Colombo, Sri Lanka. For anything in this policy, reach us at hello@loomtech.io or on WhatsApp at +94 70 642 4691.

The two roles we play

For our own customers — the businesses who sign up — we are the controller. We decide what account data we collect and why, and this policy governs it.

For their customers — the people who message a business through WhatsApp, Instagram, Messenger, Telegram or a web chat widget — we are a processor. The business decides what happens to those conversations; we act on their instructions and nothing else. If you messaged a business and want your conversation deleted, ask that business. We will help them do it, but we will not act on it without them.

What we collect

From businesses who sign up

• Name, business name, email address and phone number.
• The documents you send us to build the knowledge base — price lists, opening hours, policies, FAQs.
• Which channels you connected, and the access tokens needed to send and receive on them.
• Billing records. We never see or store your full card number.

From conversations passing through the bot

• The messages themselves, in full, in both directions.
• Whatever the channel attaches to them: a phone number on WhatsApp, a handle on Instagram or Telegram, a display name, a timestamp.
• Any files or images a customer sends, where the channel allows them.

We do not ask for and have no use for identity documents, card numbers or health information. If a customer of yours types one into a chat it will sit in that conversation like any other message, so tell your bot not to ask for them.

From this website

This page sets one item of browser storage, remembering whether you chose light or dark mode. That is all. There are no advertising cookies, no tracking pixels and no third-party analytics scripts, which is why you were not shown a cookie banner — there is nothing to consent to. Our host, Cloudflare, keeps standard server logs including IP addresses for security and abuse prevention.

Why we use it, and on what basis

• To run the service — reading your documents, generating replies, showing you your inbox. Necessary to perform our contract with you.
• To support you — answering your questions, which sometimes means looking at a conversation you point us to.
• To keep the service working and safe — diagnosing faults, investigating abuse, preventing fraud. Our legitimate interest in a service that stays up.
• To bill you — and to keep the records we are required to keep.

We do not sell personal data, we do not share it for advertising, and we do not build profiles of anyone for our own purposes.

How the AI uses your data

When a customer asks a question, the relevant extracts from your documents and the recent conversation are sent to our model provider so a reply can be generated, and the reply comes back. The content is processed for the length of that request.

Your documents and your conversations are not used to train any model — not ours, not our provider’s. The bot answers only from what you gave it. When the answer is not in your documents it says so and points the customer at your phone number, rather than inventing one.

Who else touches it

We use the following processors. Each is bound by contract to use the data only to provide its service to us:

• Meta Platforms — Delivers WhatsApp, Instagram and Messenger messages to and from us.
• Telegram — Delivers Telegram messages, where that channel is enabled.
• Google Cloud — Hosts the application and stores uploaded documents.
• MongoDB Atlas — Stores conversations, knowledge bases and account records.
• Anthropic — Generates the replies. Messages are sent for the length of the request and are not retained for training.
• Cloudflare — Serves this website and protects it from abuse.

We will also disclose data where the law requires it, and to a buyer if the business is ever sold — in which case this policy travels with it and you will be told before anything changes.

Where it is stored

Our infrastructure providers operate data centres outside Sri Lanka, so your data is processed abroad. Transfers rely on the standard contractual protections those providers offer. Tell us if this matters for your business and we will tell you exactly which regions your tenant runs in.

How it is protected

• Every business is isolated at the database level. Your conversations are never mixed with another customer’s.
• Encrypted in transit, and at rest by our storage providers.
• Access by us is limited to the people who need it to support you, and only for as long as they need it.

No system is perfect. If we ever discover a breach affecting your data we will tell you, and the regulator where required, without sitting on it.

How long we keep it

• Conversations: 24 months, unless you ask for a shorter window — we can set one per account.
• Knowledge base documents: for as long as your account is open.
• Account and billing records: for as long as your account is open, then as long as tax and accounting law requires.
• After you close your account: we delete your data within 30 days, except what we must legally retain. Ask and we will confirm when it is done.

Your rights

Under Sri Lanka’s Personal Data Protection Act and, if you are in the EU or UK, the GDPR, you can ask us to show you what we hold about you, correct it, delete it, hand it over in a portable form, or stop a particular use of it.

Write to hello@loomtech.io. We will reply within 30 days. There is no charge. If we get it wrong you can complain to the Data Protection Authority of Sri Lanka, or to your local regulator.

If your request is about a conversation you had with a business using Omnipulse, we have to send you to that business — see the two roles above.

Children

Omnipulse is sold to businesses and is not intended for children. We do not knowingly collect data from anyone under 16. If a child has messaged a business through the bot and you want that removed, contact the business, or us, and we will deal with it.

Changes to this policy

We will update the date at the top whenever this changes. If a change meaningfully affects how we handle your data we will email you about it before it takes effect, rather than leaving you to notice.