Privacy Policy
v1.0 · Approved 14 July 2026 · ICO registered — registration number ZC198477.
1. Who we are
Intrinsic Loop ("Loop", "we") is operated by We Are Intrinsic Limited (company no. 13158150), registered office: Mabgate Business Centre, Mabgate, Leeds, LS9 7DR, England. Contact: hello@weareintrinsic.co.uk. We are registered with the ICO as a data controller, registration number ZC198477.
2. The two hats we wear
(a) As a processor. Most personal data in Loop belongs to callers, form-fillers and visitors of our customers' websites. For that data, our customer is the controller and we are their processor, acting on their instructions under our Data Processing Agreement. If you have called or enquired with a business that uses Loop, your request should go to that business — though our tooling will help them answer it quickly (see §8).
(b) As a controller. For visitors to intrinsicloop.com, our own customers' account details, billing information and support correspondence, we are the controller, and this policy describes that processing.
3. What we process, and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Customer account data (name, email, company) | Providing the service, support | Contract |
| Billing data (via Stripe) | Payment, invoicing, tax | Contract / legal obligation |
| Our website analytics & lead capture (Loop's own tag) | Understanding what marketing works — the same product we sell | Consent (via our banner) / legitimate interests for essential operation |
| On behalf of customers (processor role): caller phone numbers, call recordings, transcripts, AI analyses, form/chat submissions, visitor identifiers, attribution data | Delivering the product | Customer's instructions (their lawful basis) |
4. Where data lives
Loop's database, processing and call-recording storage are located in London, United Kingdom. Call audio is copied to UK storage when a call completes, and the telephony provider's copy is deleted the moment ours is confirmed. Limited processing by sub-processors may occur outside the UK (transcription, AI analysis) under the UK International Data Transfer Addendum — see the Sub-processor List.
5. Retention
Default retention is 12 months on a rolling basis: recordings and transcripts are destroyed on schedule and personal details anonymised by an automatic nightly process, while anonymised statistics are retained. Customers may configure shorter (90 days) or longer windows (24/36 months, or up to 7 years for regulated sectors). Account data is kept for the life of the account plus 30 days, then erased (billing records retained as legally required, typically 6 years).
6. Security
Tenant isolation enforced at the database layer (row-level security); encryption in transit and at rest; MFA-protected infrastructure; rate-limited public endpoints; security-headers hardening; audit logging of privacy-relevant actions; a tested incident-response procedure including UK GDPR 72-hour breach-notification assessment.
7. Sub-processors
A functions-and-regions overview is published at /subprocessors; the named list is provided to customers at contracting and on request, with 30 days' email notice of changes to account owners.
8. Your rights
Access, rectification, erasure, restriction, portability, objection. For data we hold as controller: hello@weareintrinsic.co.uk, answered within one month. For caller data (processor role): contact the business you dealt with; Loop provides them built-in search, export and erasure tooling, so requests are typically fulfilled promptly. You may complain to the ICO (ico.org.uk).
9. Cookies on this website
Strictly necessary cookies only, until you tell us otherwise. Nothing analytics or advertising related is set unless you accept it in the cookie banner, which appears on your first visit and starts with everything optional switched off.
Three categories:
- Strictly necessary — security and load balancing, plus one first-party cookie (
loop_consent, six months) recording your cookie choice so we do not ask again. - Analytics — Google Analytics 4, so we can see which pages get read and which channels bring visitors. Aggregated reporting only.
- Marketing — lets us measure whether our own advertising produced a demo booking, so we can stop paying for advertising that does not work.
We use Google Consent Mode v2. Before you choose, Google’s tags are set to denied for both analytics and advertising storage, and advertising data is redacted. Change or withdraw your choice at any time via , which sits in the footer of every page, or by clearing cookies in your browser.
Separately, the Loop tag installed on our customers’ websites sets identifiers only where that site’s own consent mechanism permits it. That processing is covered by the customer’s privacy notice, not this one.
10. Changes
Versioned; material changes notified to account owners by email. Prior versions available on request.