Privacy Policy
v1.0 · Approved 14 July 2026 · ICO registered — registration number ZC198477.
1. Who we are
Intrinsic Loop ("Loop", "we") is operated by We Are Intrinsic Limited (company no. 13158150), registered office: Mabgate Business Centre, Mabgate, Leeds, LS9 7DR, England. Contact: hello@weareintrinsic.co.uk. We are registered with the ICO as a data controller, registration number ZC198477.
2. The two hats we wear
(a) As a processor. Most personal data in Loop belongs to callers, form-fillers and visitors of our customers' websites. For that data, our customer is the controller and we are their processor, acting on their instructions under our Data Processing Agreement. If you have called or enquired with a business that uses Loop, your request should go to that business — though our tooling will help them answer it quickly (see §8).
(b) As a controller. For visitors to intrinsicloop.com, our own customers' account details, billing information and support correspondence, we are the controller, and this policy describes that processing.
3. What we process, and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Customer account data (name, email, company) | Providing the service, support | Contract |
| Billing data (via Stripe) | Payment, invoicing, tax | Contract / legal obligation |
| Our website analytics & lead capture (Loop's own tag) | Understanding what marketing works — the same product we sell | Consent (via our banner) / legitimate interests for essential operation |
| On behalf of customers (processor role): caller phone numbers, call recordings, transcripts, AI analyses, form/chat submissions, visitor identifiers, attribution data | Delivering the product | Customer's instructions (their lawful basis) |
4. Where data lives
Loop's database, processing and call-recording storage are located in London, United Kingdom. Call audio is copied to UK storage when a call completes, and the telephony provider's copy is deleted the moment ours is confirmed. Limited processing by sub-processors may occur outside the UK (transcription, AI analysis) under the UK International Data Transfer Addendum — see the Sub-processor List.
5. Retention
Default retention is 12 months on a rolling basis: recordings and transcripts are destroyed on schedule and personal details anonymised by an automatic nightly process, while anonymised statistics are retained. Customers may configure shorter (90 days) or longer windows (24/36 months, or up to 7 years for regulated sectors). Account data is kept for the life of the account plus 30 days, then erased (billing records retained as legally required, typically 6 years).
6. Security
Tenant isolation enforced at the database layer (row-level security); encryption in transit and at rest; MFA-protected infrastructure; rate-limited public endpoints; security-headers hardening; audit logging of privacy-relevant actions; a tested incident-response procedure including UK GDPR 72-hour breach-notification assessment.
7. Sub-processors
A functions-and-regions overview is published at /subprocessors; the named list is provided to customers at contracting and on request, with 30 days' email notice of changes to account owners.
8. Your rights
Access, rectification, erasure, restriction, portability, objection. For data we hold as controller: hello@weareintrinsic.co.uk, answered within one month. For caller data (processor role): contact the business you dealt with; Loop provides them built-in search, export and erasure tooling, so requests are typically fulfilled promptly. You may complain to the ICO (ico.org.uk).
9. Cookies on this website
Essential cookies only, plus our own Loop tag for attribution which sets identifiers only after consent via our banner. Details and controls in the banner.
10. Changes
Versioned; material changes notified to account owners by email. Prior versions available on request.