Privacy Policy

Loomaru is operated by Vadim Sharapov, sole proprietor, based at Zikova 1023, Prague, Czech Republic. As an EU-based provider, we are directly subject to the General Data Protection Regulation (GDPR).

This Privacy Policy covers two distinct contexts:

1. This website (loomaru.com) — where we are the data controller for visitor information.
2. Our revenue recovery service — where we act as a data processor on behalf of our merchant clients, who are the data controllers.

For full data processing terms governing the revenue recovery service, see our Terms & Conditions, Section 4.

When you visit loomaru.com, we act as the data controller for any personal data collected. The legal basis for processing depends on the type of data:

• Analytics and advertising cookies: Consent (GDPR Art. 6(1)(a), ePrivacy Art. 5(3)). These are only activated after you accept tracking via our cookie consent banner.
• Contact form / booking submissions: Legitimate interest (GDPR Art. 6(1)(f)) — you initiate the contact, and we process your information to respond and provide the requested service.
• Strictly necessary cookies: Exempt from consent under ePrivacy Art. 5(3) — these are required for the website to function (e.g., theme preference stored in localStorage).

loomaru.com relies on categories of third-party service providers, described below. The first table lists back-end providers that are not user-facing (hosting, managed data infrastructure, embedded scheduling). The second table lists consent-gated tracking tags that may be placed on your device only after you accept the matching consent category. For the per-cookie detail, see our Cookie Policy, §3.

Category-level disclosure.We disclose back-end providers at category level to protect the operational integrity of the Service. The current named list of sub-processors is available to Controllers and regulators on written request under a confidentiality undertaking, together with each provider's DPA, SCCs, and DPF-adherence reference where applicable.

Back-end providers (category level)

Consent-gated tracking tags (listed pending deployment)

None of the tracking tags below are loaded today. They appear here so the disclosure is accurate at the moment each one ships — and each will only ever fire after the matching consent category is granted. Because these tags are served directly by their publishers into your browser, we disclose them by name as required by the ePrivacy Directive.

loomaru.com uses cookies and similar technologies (localStorage, sessionStorage, tracking pixels). For the authoritative, per-cookie inventory — including names, providers, purposes, and retention — see our Cookie Policy. That page is the single source of truth and is kept in sync with what the site actually stores on your device. Below is a short summary only.

When a merchant subscribes to Loomaru's revenue recovery service, we act as a data processoron behalf of the merchant (the data controller). We process personal data from the merchant's customers solely under the merchant's instructions and for the purpose described in our Data Processing Terms.

If you are a shopperwho purchased from one of our merchant clients: the merchant is the controller of your data. Your rights regarding your purchase data should be exercised with the merchant directly, through their privacy policy and contact channels. If you have questions about how Loomaru processed your data on the merchant's behalf, you may also contact us at vadim@loomaru.com.

When a merchant's end-customer completes a purchase, a defined subset of the order record is received from the merchant's Store, reconciled in transient memory, and forwarded to the advertising destinations the merchant has designated. The exact subset is determined per-destination by each destination's published specification and the merchant's configured profile.

The Service receives order data from the merchant's Store, reconciles and pseudonymizes the identity fields in transient memory, and forwards matched conversion signal to the advertising destinations the merchant has designated. Typical end-to-end processing time is under three seconds. No Customer Data is retained at rest.

What is NOT sent to any destination: raw email, raw phone number, raw name, or raw address. These are always pseudonymized before transmission. Empty or null fields are omitted entirely — never sent as empty hashes.

What is NOT stored by Loomaru: customer identity fields (pseudonymized or raw), network identifiers, order payloads, or destination-specific request bodies. None of this is written to any database, file, queue, cache, or log.

For the revenue recovery service, Loomaru engages sub-processors from the following category:

Named list on request. The current named list of sub-processors, their addresses, and their individual DPA / SCC / DPF references are available to Controllers and regulators on written request under a confidentiality undertaking.

Ad Destinations are not sub-processors. Each advertising destination receives data under the merchant's direct controller relationship with that destination. Loomaru forwards data to each destination on the merchant's instruction.

For the loomaru.com website, additional back-end providers are described at category level in Section 4 above.

Loomaru is based in the EU (Czech Republic) and is directly subject to GDPR. No Article 27 representative is required.

Website datamay be transferred to the United States by the consent-gated tracking providers listed in Section 4, and — for merchants who book a call — by the embedded scheduling provider. All such transfers are covered by a combination of EU Standard Contractual Clauses and approved frameworks (including the EU-US Data Privacy Framework where the counter-party is self-certified). Data stored in our managed data & identity platform remains in the EU region.

Service datais processed at the nearest available compute location of our infrastructure sub-processor, some of which may be outside the EU/EEA. Every such transfer is covered by written sub-processor agreements with EU Standard Contractual Clauses (Module Two and Module Three) and approved framework safeguards. Processing is transient — no Customer Data is stored at any compute location. Any onward transfer to an advertising destination occurs under the merchant's direct relationship with that destination, covered by that destination's published transfer mechanism.

Loomaru's website and service are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately at vadim@loomaru.com and we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service features. Material changes will be communicated via email (for merchant clients) or a notice on this page. The "Last updated" date at the top reflects the most recent revision.

For changes affecting the Data Processing Terms, we will provide at least 30 days' notice before the changes take effect, giving merchants the opportunity to review and, if necessary, terminate the service.