This Privacy Policy explains how MustLoop, a service operated by Sparkling Opinions, Lda ("MustLoop", "we", "us", or "our"), collects, uses, stores, and shares information when you use our website and application (the "Service"). MustLoop is an outreach tracking tool that connects to your Gmail account to surface your professional conversations, remind you to follow up, and help you draft replies, while keeping you in control of everything that is sent.
By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Who we are
The Service is operated by Sparkling Opinions, Lda, a company registered in Portugal (VAT PT517454483) with its registered office at Travessa Fonte do Bispo 17, 3030-243 Coimbra, Portugal. Sparkling Opinions, Lda is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). For any privacy matter you can reach us at privacy@mustloop.com.
Information we collect
Account information
When you sign in with Google, we receive your name, email address, and profile picture from your Google account so we can create and secure your MustLoop account.
Google user data (via the Gmail API)
With your explicit consent, MustLoop requests the following Google API scopes. We request only what the Service needs to function:
- View your email messages and settings (
gmail.readonly): to detect your professional email threads, build your conversation timeline, summarize threads, and identify which conversations need a follow-up. - Send email on your behalf (
gmail.send): to deliver replies and first touch messages that you have composed and explicitly approved. MustLoop never sends email automatically or without your direct action.
Usage information
We collect limited technical and usage information to operate, secure, and improve the Service:
- Website analytics: the pages you visit, how you arrived (the referring site and any campaign tags in the link), how long you stay, your browser, device type, and approximate location derived from your IP address. Links that contain secrets or personal data, such as password reset links, are stripped of them before they are recorded.
- Product analytics: which features you use and when, such as connecting an account, sending a reply, adding leads, or using MustLoop from an AI assistant over MCP (including which assistant and which tools). These events identify you by your account, your email address and your workspace's name, and never include the content of your emails or the details of your contacts.
- Log data: technical logs and error reports used to keep the Service running.
How we use Google user data
- Surface your sent and received professional conversations in one place.
- Detect conversations that are going cold and remind you to follow up.
- Generate short thread summaries and suggested draft replies in your writing style.
- Send only the messages you have reviewed and approved.
MustLoop is human in the loop by design: it surfaces information and prepares drafts, but you decide what, if anything, is sent.
How we store and retain data
We are deliberately minimal about what we keep:
- We do not store the full content of your email messages. Message bodies are fetched transiently to produce a summary or draft and are not persisted on our servers.
- We store conversation metadata needed to run the Service: sender and recipient names and email addresses, subject lines, timestamps, a short snippet, an AI generated summary, and conversation status.
- Drafts you haven't sent yet, such as a first email to a lead, are kept so you can come back to them. A draft is deleted when you send it, discard it, or delete the contact.
- Your Google OAuth tokens are stored encrypted and are used only to provide the Service.
We retain this data for as long as your account is active. When you disconnect your Gmail account or delete your account, we delete the associated data and revoke stored tokens, except where we are required to retain limited records to comply with legal obligations.
AI processing and service providers
To generate summaries and draft replies, the relevant message text, along with the notes and activity you have logged about those contacts, is sent transiently to our AI provider, Anthropic (the Claude API), solely to produce that output and return it to you. This content is processed transiently and is not used to train models.
We also rely on a small number of service providers (subprocessors) to operate the Service. Each processes data only on our instructions and under appropriate confidentiality and data protection obligations:
- Anthropic: AI processing (summaries and draft replies), as described above.
- Cloud hosting infrastructure: to run and store data for the Service.
- Stripe: payment processing for paid subscriptions.
- PostHog: website and product analytics (described under "Usage information"), and error tracking for the web app, used to understand how the Service is used, to detect and fix problems, and to improve it. Error reports include the error message and where in our code it happened, with email addresses removed. We run PostHog in a cookieless configuration, do not record sessions, do not capture the text of what you click, and do not use it for advertising.
- Resend: delivery of the emails we send you, such as the daily digest, which contains the summaries of the conversations that need you.
- Laravel Nightwatch: application monitoring, so we can see errors, slow requests and failed background jobs. It receives technical records such as timings, database queries and error details, never the content of your email.
Limited Use disclosure
MustLoop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we do not:
- use Google user data for advertising;
- sell Google user data;
- transfer Google user data except as necessary to provide or improve the Service, comply with law, or as part of a merger or acquisition; and
- allow humans to read your Google user data, unless: (a) you give specific consent; (b) it is necessary for security purposes (such as investigating abuse); (c) it is required to comply with applicable law; or (d) the data has been aggregated and anonymized.
Cookies
We use only strictly necessary cookies, for example to keep you signed in and to protect against cross-site request forgery. These are required for the Service to function and do not track you across other sites. Our analytics (PostHog) run cookieless, and we do not use advertising or cross-site tracking cookies. For details, see our Cookie Policy.
How we share information
We do not sell your personal information or your Google user data. We share information only with the subprocessors described above, or when required by law or to protect the rights, property, or safety of MustLoop and its users.
Your rights and choices
Under the GDPR you have the right to access, correct, export, or delete your personal data, to restrict or object to certain processing, and to withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD). You can exercise the following directly in the app:
- Disconnect Gmail at any time from within the app. This revokes our access and removes the associated data.
- Delete your account to remove your data from the Service.
- You can also review and revoke MustLoop's access from your Google Account at myaccount.google.com/permissions.
- To make any other request about your data, email us at privacy@mustloop.com.
Security
We use industry standard measures to protect your information, including encryption in transit, encryption of stored OAuth tokens, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to limit what we collect in the first place.
Children's privacy
The Service is not directed to children and is intended for users aged 18 and over.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.
Contact us
Sparkling Opinions, Lda, Travessa Fonte do Bispo 17, 3030-243 Coimbra, Portugal. If you have questions about this Privacy Policy or our data practices, contact us at privacy@mustloop.com.