Legal information

Cookie policy

Last updated: 7 October 2026 · 13 min read

This policy describes the cookies and similar records written to your browser on the website at loop.n-xplus.com (the “Site”) and in the Loop app: what each record is used for, how long it stays, who writes it and how you can manage your preferences. MercanWorks OÜ is the controller of the personal data processed through these records. This policy applies together with the Privacy policy and the KVKK privacy notice.

In short: the Site and the app use only necessary records to work. The only use that is not necessary is Google Ads advertising measurement; it is off by default and runs only if you give permission. If you do not give permission, the Google tag is not loaded and you can use the Site and the product in the same way.

1. What is a cookie

A cookie is a small text file that your browser saves on your device when you visit a website. Websites use cookies to keep you signed in, remember your preferences or measure the result of an action.

Besides cookies, browsers offer two similar storage areas. Records in local storage (localStorage) stay on your device and, unlike cookies, are not sent to the server with every request. Records in session storage (sessionStorage) last only while the open tab is alive and are deleted by the browser when the tab is closed. This policy covers all three areas; the word “record” in this text means an entry in any of them.

Records are divided into two groups by duration: session records are deleted when the tab or browser is closed, and persistent records remain for a set period or until you delete them. They are also divided by the domain that writes them: first-party records are written to the domain of the site you visit (loop.n-xplus.com), and third-party records to another domain.

2. Why we use records

• To serve the Site securely and protect it against automated or malicious traffic.
• To keep you signed in to the app and complete sign-in flows securely.
• To remember your chosen language, display and working layout the next time you open the app.
• To remember your cookie choice so that you are not asked again on every page.
• Only if you give permission, to measure with Google Ads how many new sign-ups our ads bring.

3. Categories

3.1. Necessary

The records in this category are either strictly necessary for the Site and the app to work or perform a function you have explicitly requested (for example remembering your display choice or the mail account you connected). Under the Turkish Personal Data Protection Authority’s Guide on Cookie Practices, such records do not require explicit consent. They are not used for advertising or tracking and are shown as “Always on” in the “Cookie preferences” panel. If you block them, you cannot sign in and the app does not work.

Necessary records fall into four groups: the Site’s records, the app’s session and security records, preference records written when you make a choice, and Cloudflare’s security cookies. The full list is in the table in section 4.

3.2. Advertising measurement (Google Ads)

This category is off by default and runs only if you choose “Accept all” in the cookie banner or the panel, or turn on the switch in the “Cookie preferences” panel and choose “Save selection”. Its purpose is to measure how many new sign-ups our ads bring. How it works and which data is sent to Google are described in section 5.

3.3. Records we do not use

Loop has no analytics cookies, social media plugins or pixels, live chat tools, or remarketing and profiling records. Visits to the Site are counted with Cloudflare Web Analytics; this service writes no cookie or other record to your device and creates no individual-level profile, producing only aggregate counts by page, referrer, browser type and country. If an error occurs in the app, a masked technical summary of the error is sent to the server; this record is not written to your device.

4. Cookie and record table

Your display preference (theme, mode, background, accent colour) and dashboard layout are also saved to your account so that they open the same way on a new device; the other preferences have no copy on the server. List filter, view and column preferences are kept separately for each company, and the company ID is added to the end of the record name.

A browser notification is not a cookie but a permission setting in your browser. When you turn notifications on, your browser creates a subscription address and encryption keys; this subscription is stored on our server so that notifications can reach you, and it is based on your explicit consent. The background script (service worker) installed for notifications only receives notifications; it does not cache app files and does not interfere with your network requests.

5. How advertising measurement works

If you allow advertising measurement, the Google Ads conversion tag runs. The tag does not run inside the pages; it opens in a separate frame at loop.n-xplus.com that contains no other content, and only at two moments:

• When you arrive by clicking one of our ads, it stores the click information and sends Google a page view notification.
• When you set up a company in Loop, whether or not you came from an ad, it sends Google a single sign-up notification. Google counts this notification as a conversion only if it can match it to an ad click.

The frame closes when its work is done, and your navigation in the app is not measured.

Data sent to Google: The address of the Loop page you visit (without the query part of the address), the random identifier assigned to your browser, the ad click identifier (gclid, gbraid, wbraid) and the cookie that carries it, the random transaction number generated when a company is set up, IP address, page title, browser, screen and device information, consent status and time of the event. The page address is sent to Google with the query part removed; information added to the address and the address of the external page that referred you to the Site are not sent to Google. The ad click identifier is taken from the address separately, and only this identifier is transmitted.

Data not sent to Google: Name, email address, phone number, company information, task content or encrypted hashes of these are not sent. Enhanced conversions, automatic collection of personal data on the page by the tag, personalised advertising, Google Signals and remarketing are turned off. In Google’s consent mode, only the ad storage and ad user data permissions are granted; the personalisation and analytics permissions always remain denied.

Legal basis and roles: The legal basis is your explicit consent (KVKK Art. 5/1; GDPR Art. 6/1-a). MercanWorks OÜ, which places the tag on the Site and enables the collection of this data, is the controller. Google Ireland Limited (Ireland) and Google LLC (USA), which receive the data, process it for their own purposes and under their own terms as independent controllers; Google may also process the data on its servers in other countries. How Google uses this data is explained on the page “How Google uses information from partner sites”. Google states that it removes part of the IP address from ad server logs after 9 months and cookie information after 18 months.

Transfer abroad: For visitors in Turkey, giving permission means that your data is transferred outside Turkey. The Turkish Personal Data Protection Board has not issued an adequacy decision for these countries; they may not offer protection and legal remedies equivalent to those in Turkey, public authorities there may access the data under their own law, and it may be harder for you to exercise your rights against Google. For visitors in the European Economic Area, the data is received by Google Ireland Limited; Google states that it relies on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework when transferring the data to the USA. Details are in the section on transfers abroad in the Privacy policy.

Rejecting and withdrawing: “Reject all” and “Accept all” are the same size and look the same. Closing the banner, scrolling the page or navigating the site does not count as permission. If you reject, no request is sent to Google, not even a cookieless measurement request. You can withdraw your permission at any time; when you do, the advertising cookies and the Google tag’s local storage record are deleted and no further data is sent to Google. Withdrawal does not affect the lawfulness of processing carried out before it.

6. How to manage your preferences

6.1. Cookie banner and “Cookie preferences” panel

When you first open the Site, a cookie banner appears at the bottom of the page. It offers three options:

• Accept all: Advertising measurement is turned on.
• Reject all: Advertising measurement stays off.
• Manage preferences: The “Cookie preferences” panel opens. In the panel you can read the description of each category and its “Records used” list, turn the advertising measurement switch on or off and choose “Save selection”.

Your choice is kept in this browser in the “loop-olcum” record, and you are not asked again for 365 days. You can change your choice at any time with the “Cookie preferences” link in the page footer; the panel opens with your saved choice. If the purpose of advertising measurement, the data sent to Google or the recipients change, you are asked again.

6.2. Within the app

When you sign out from the account menu, the session token is deleted. When you remove an account’s connection on the Mail screen, that account’s tokens and email address are deleted from your device. You can remove the browser notification subscription in the app settings; this also deletes the subscription record on the server.

6.3. In your provider account

You can revoke the mail access you gave Loop on the third-party app permissions page of your Google account and in the app permissions section of your Microsoft account’s privacy settings. After revocation, Loop cannot obtain new tokens and the Mail screen asks you to connect again. The record on your device is deleted when you remove the account on the Mail screen.

6.4. In your browser settings

You can delete or block cookies and site data in your browser settings at any time. In Chrome these settings are under “Privacy and security”, in Safari under “Manage Website Data” in the “Privacy” section, in Firefox under “Cookies and Site Data” in “Privacy & Security”, and in Edge under “Privacy, search, and services”. Detailed instructions are on the browser vendors’ help pages:

Google Chrome →

Mozilla Firefox →

Apple Safari →

Microsoft Edge →

6.5. Effect of deleting

When you delete site data, all records in this policy are deleted: you are signed out and need to sign in again, your display preferences return to the default (the display choice saved in your account is applied again after you sign in), connected mail accounts are disconnected and your cookie choice is asked again. Your business data in Loop is kept on the server and is not deleted by this.

7. Legal bases

• Necessary records: Session, flow verification and security records are strictly necessary to provide the Service; preference and mail connection records perform a function you have explicitly requested. These records fall within the criterion in the Authority’s Guide on Cookie Practices of being “strictly necessary for an information society service explicitly requested by the subscriber or user in order to receive the service” and the exemption in Article 5(3) of the ePrivacy Directive 2002/58/EC, and do not require explicit consent. For the personal data processed through these records, the legal basis is the formation and performance of a contract for session and preference records (KVKK Art. 5/2-c; GDPR Art. 6/1-b) and the legitimate interest in serving the Site securely for Cloudflare’s security cookies (KVKK Art. 5/2-f; GDPR Art. 6/1-f). For the cookie choice and language records on the Site, the legal basis is legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6/1-f). The data in the mail connection record never reaches our servers and is processed only on your device.
• Advertising measurement: Explicit consent (KVKK Art. 5/1; GDPR Art. 6/1-a).
• Browser notification subscription: Explicit consent (KVKK Art. 5/1; GDPR Art. 6/1-a).

8. Pages of other organisations

Payment for a paid plan takes place on Stripe’s payment page on its own domain, where Stripe’s cookies and cookie policy apply. When you connect your mail account, you are redirected to Google’s or Microsoft’s sign-in page, where the provider’s cookies apply; these cookies are not written to Loop pages. When you open a message on the Mail screen, remote images in the message are loaded in a separate frame that does not run scripts; because the image is downloaded directly from the sender’s server to your browser, that server may learn your IP address and that the message was opened. This is not a Loop record, and no request is sent unless the message is opened.

9. Relevant Google pages

How Google uses information from partner sites →

How Google uses cookies and the duration of advertising cookies →

Google Privacy Policy →

Google’s data transfer frameworks →

Google My Ad Center (ad settings in your Google account) →

Cloudflare cookies →

Stripe cookie policy →

Microsoft Privacy Statement →

10. Changes to this policy

We update this policy when the product, the law or providers’ terms change and show the update date at the top of the page. The table reflects the product’s operation as of the update date. If the purpose of advertising measurement, the data sent to Google or the recipients change, your cookie choice is asked again.

11. Contact

For questions about this policy and the records kept in your browser, you can write to [email protected], and for general questions to [email protected]. Controller: MercanWorks OÜ, Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Paavli tn 5a/1, 10412, Estonia. Registry code 17413775, VAT number EE103019451.