SureLoop ("SL", "we", "us") operates the SureLoop service at sureloop.com — an AI-assisted quoting and sales tool for businesses. SL is operated from Switzerland; a Swiss limited liability company is in formation and will assume responsibility under this policy upon incorporation (see section 13).
This policy explains how we handle personal data when you visit our websites, create an account, or use the SureLoop service (together, the "Service"). It is written to comply with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) where it applies, and the Google API Services User Data Policy.
Two roles matter throughout this policy. For your account, billing, website and usage data, SL is the controller. For the content of mailboxes and business data you connect to the Service, SL acts as a processor on your instructions — see section 11.
If you connect an email account (for example Gmail or Google Workspace), we access mailbox data through our email infrastructure provider, Nylas, using OAuth authorization that you grant. Depending on the features you use, this includes message content and attachments, message metadata (sender, recipients, subject, timestamps), labels or folders, thread history, and drafts we create for you. We never see or store your email password. Section 3 describes our handling of Google data specifically.
When you use the Service we collect log and usage data such as IP address, browser and device information, pages viewed, feature usage and error events. Cookies and similar technologies are described in our Cookie Policy.
If you connect optional integrations (for example accounting or CRM tools), we receive the data those services make available under the permissions you approve on their authorization screens.
This section applies when you connect a Gmail or Google Workspace account to the Service.
With your OAuth consent, the Service accesses your Gmail data via Nylas to: read email messages and their metadata in the connected mailbox; read and apply labels (for example a label you use to flag messages for a drafted reply); create and update drafts containing suggested quotes and replies; and, where the product offers in-app sending, send a message only when you explicitly instruct it to. SureLoop is designed as a review-first tool: suggested replies are placed in your mailbox as drafts for you to check and send.
We use Google user data solely to provide and improve user-facing features of the Service that you have requested: detecting quote requests and relevant inbound messages, extracting the inputs needed for a quote (quantities, materials, dimensions, dates and similar), generating draft quotes and replies using your configured pricing logic, and keeping track of the related email threads.
SureLoop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
You can disconnect a mailbox at any time in the Service settings, or revoke SureLoop's access from your Google Account security settings. When you disconnect a mailbox or delete your account, we delete the associated Google user data from our systems within 30 days, except where retention is required by law. You may also request deletion at any time via privacy@sureloop.com.
We use personal data to: provide, operate and secure the Service; generate quote and reply drafts you request; set up and maintain your account and plan; process payments and send invoices; provide support; monitor performance, debug and prevent abuse; send service and transactional messages; send occasional product updates you can opt out of; and comply with legal obligations.
Where the GDPR applies, our legal bases are: performance of a contract (providing the Service you signed up for), legitimate interests (securing and improving the Service, business communications with professional users), consent (where we ask for it, for example optional analytics cookies), and compliance with legal obligations (for example accounting rules). Under the Swiss FADP we process data in line with the principles of that act.
To generate drafts and quotes, the Service sends the content needed for that specific task — for example the text of an inbound inquiry and your relevant pricing configuration — to carefully selected AI model providers . These providers process the content only to return the result to us; our agreements with them prohibit use of your content to train their models and limit how long they may retain it. Quote figures are produced by your configured pricing logic; the AI is used to read inquiries and draft the surrounding communication.
We do not sell personal data and we do not share it with advertising networks. We share personal data only with:
| Recipient | Role | Location |
|---|---|---|
| Nylas, Inc. | Email API infrastructure (mailbox sync, drafts) | USA |
| Stripe | Payment processing and billing | USA / EU |
| Vercel Inc. | Hosting and content delivery | USA / EU |
| Anthropic PBC | AI model processing (section 5) | USA |
| Email delivery provider | Transactional email (receipts, notifications) | USA / EU |
We may also share personal data with professional advisers (lawyers, accountants, auditors) under confidentiality, with authorities where required by law or to protect rights and safety, and in connection with a corporate transaction such as the incorporation of our successor Swiss company, a financing, merger or sale of assets — in which case this policy continues to apply to your data and we will notify you of any change of controller.
We are based in Switzerland and use service providers in Switzerland, the European Economic Area and the United States. Where personal data is transferred to a country without an adequate level of data protection, we rely on appropriate safeguards, in particular the EU Standard Contractual Clauses (with the Swiss addendum where relevant) and, for certified US providers, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, OAuth-based mailbox access with least-privilege scopes (we never handle your email password), access controls and logging, and separation of customer data. No system is completely secure; we cannot guarantee absolute security, but we will notify you and the competent authorities of personal data breaches where the law requires it.
Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. To exercise these rights, contact privacy@sureloop.com; we will respond within the statutory deadline.
If you are in Switzerland, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EEA or UK, you may complain to your local supervisory authority.
If you are a resident of a US state with a consumer privacy law (such as California), you have equivalent rights of access, correction and deletion. We do not sell personal information and do not share it for cross-context behavioral advertising.
The mailboxes and business data our customers connect to the Service contain personal data of third parties — their clients, suppliers and correspondents. We process that data as a processor, only on our customer's documented instructions and only to provide the Service. If your data appears in a SureLoop customer's mailbox and you wish to exercise your privacy rights, please contact that business directly; we will support them in responding. A data processing agreement reflecting Art. 28 GDPR and the FADP is available to customers on request at privacy@sureloop.com.
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.
We may update this policy as the Service and the law evolve — including to reflect the assumption of the Service by our successor Swiss company, which will not reduce your rights under this policy. For material changes we will notify you by email or in the Service before they take effect. The "Effective date" above always shows the current version.
Questions and requests regarding this policy or your personal data: privacy@sureloop.com.