Legal information

Privacy policy

Last updated: 7 October 2026 · 26 min read

MercanWorks OÜ (“we” or the “Company”) values the privacy and security of your personal data. Loop is a task tracking and no-code automation service for small and medium-sized businesses, provided by MercanWorks OÜ under the N-XPLUS brand.

This policy explains how your personal data is collected, for which purposes it is used, with whom it is shared, how long it is kept and how it is protected when you use the website at loop.n-xplus.com (the “Site”) and the Loop application (the “Service”). It describes the product’s current operation; when the product changes, this page is updated with a new date, and data is not processed for any purpose not stated here.

A separate KVKK privacy notice is published for people resident in Turkey, and both documents apply together. Cookies and the records kept in your browser are described in detail in the Cookie policy.

1. Controller

MercanWorks OÜ is a company incorporated under the laws of the Republic of Estonia and established in the European Union. The processing of your personal data is therefore subject to the EU General Data Protection Regulation (“GDPR”) wherever you live; for people resident in Turkey, Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) also applies.

1.1. Our role for each type of data

Because of the way the Service works, MercanWorks OÜ acts in two different roles. This distinction matters because it determines against whom you exercise your rights.

• As controller: We process your account data (name, email address, password hash, your role in your company, your preferences), the personal data in your company’s subscription records (the company owner’s email address, the name of a natural person in the billing details), the technical records kept for the Service to work and the data of the advertising measurement that runs on the Site with your permission as controller. We are your point of contact for this data.
• As processor: Your company is the controller of the business data it enters into Loop (tasks, comments, project chat messages, file attachments, form definitions and responses, field values and any customer, supplier or business partner data they may contain). We process this data only on your company’s instructions and to operate the Service. Your company is responsible for collecting it lawfully, informing the people concerned and obtaining their consent where required. We do not use this data for our own purposes, sell it, use it for advertising or use it to train any artificial intelligence model. The terms of this processing relationship (GDPR Art. 28/3) are set out in the data processing section of the Terms of use.

1.2. Loop tracks work, not employees

Loop collects no data that monitors people, such as location, screenshots, keyboard and mouse activity, activity status or online time; no such measurement exists in the product’s data model. What is measured is the task: which piece of work, at which stage and when it was completed. The measurements on the performance screen are derived from on-time task completion data and do not measure the quality of anyone’s work.

2. What data we collect

2.1. Data you provide to us directly

• Account: Your name, email address and a cryptographic hash of your password. The password exists only in hashed form at the authentication provider, is never stored in plain text and cannot be seen by us. Verifying your email address is mandatory.
• Your role in your company: Whether you are the company owner, an administrator or a member, and your access to projects restricted by an access list.
• Preferences: Your display choice (theme, light or dark mode, background and accent colour), notification preference and dashboard layout are kept in your account; other display preferences remain only on your device.
• Invitation records: The email address invited to a company and the status of the invitation (pending, accepted, cancelled, expired).
• Correspondence: When you write to [email protected] or [email protected], your name, email address, message and any information you provide to verify your identity in a rights request. The “Chat with us on WhatsApp” button on the Site starts a conversation with us on WhatsApp. If you write to us, your phone number, the name shown on your WhatsApp profile and your messages are processed to reply to that conversation; the conversation is also subject to WhatsApp’s own terms.

Name, email address and password are required to open an account; without them no account can be opened. Preferences and browser and phone notifications are optional.

2.2. Your company’s business data

The following records are entered and stored while your company uses the Service; our processor role described in 1.1 applies to them:

• Tasks, subtasks, stages, assignees and assignment history, task types and field definitions.
• Task comments and activity history (who changed what and when).
• Projects, project chat messages and files attached to messages.
• Form definitions and form responses (from in-app forms and public forms).
• Automation rules and the rule run log (which rule ran, when and with what result).
• Field values marked “confidential”. These values are stored in a separate column, are read only by people your company authorises through a single controlled path, and are never sent to the AI assistant or to public forms.

2.3. Public forms

When your company shares a form through a link, the responses written by the person filling it in are stored as your company’s business data, and your company is the controller of those responses. To limit abuse and excessive requests, a one-way hash (SHA-256) of the sender’s IP address is kept for 7 days; the IP address itself is not stored. No account is created for the person filling in the form and no cookie is written to their device.

2.4. Technical data collected automatically

• Notification records: To whom, when and through which channel a notification was sent, and its delivery status.
• Browser and phone notifications: Only if you turn them on, the subscription address and encryption keys provided by your browser, or in the mobile app your phone’s notification token and phone type.
• Automation counter and event queue: The number of rule runs (for the monthly quota) and events waiting to be processed.
• AI assistant conversation: The request you write and a summary of the response. When the summary is saved, sequences of 10 or 11 digits and email addresses are masked (section 7).
• Request data: Cloudflare, which serves the Site and the app, processes the IP address of requests temporarily under its own privacy policy. Loop keeps no access log in its own application code; Cloudflare’s and Supabase’s own operational and security logs (including IP addresses) are subject to those providers’ policies and retention periods.
• Cookieless visit counting: Visits to the Site are counted with Cloudflare Web Analytics without cookies or identifiers. This counting creates no individual-level profile; it only produces aggregate counts by page, referrer, browser type and country.
• Records kept in your browser: Records that keep you signed in and remember your preferences stay on your device. The session token is sent to the server with each request to verify your identity. The full list is in the Cookie policy. In the mobile app, the session is kept in the phone’s secure storage (Keystore on Android, Keychain on iPhone) and deleted when you sign out.
• Error records: When an error occurs in the app or on the Site, a technical summary of the error (error text, page, app version, browser type and the company, if any) is written to the server; values such as email addresses, phone numbers and ID numbers are masked before being written. Only Loop’s authorised operator can see these records.

2.5. Payment information

Payments for paid plans are processed by Stripe. Card details are entered on Stripe’s own payment page; the card number, security code and expiry date never pass through our servers and are never stored. Loop keeps only the plan, the subscription status and the Stripe customer and subscription IDs. The company name, the company owner’s email address and billing details are sent to Stripe. No card details are required for the Free plan.

2.6. Advertising measurement data collected only with your permission

If you allow advertising measurement in the cookie banner on the Site or in the “Cookie preferences” panel, the Google Ads conversion tag sends the following data directly to Google: the address of the Loop page you visit (without the query part of the address), the random identifier assigned to your browser, the ad click identifier and the cookie that carries it, the random transaction number generated when a company is set up, your IP address, and browser and device information. The page address is sent to Google with the query part removed; information added to the address and the address of the external page that referred you to the Site are not sent to Google. The ad click identifier is taken from the address separately, and only this identifier is transmitted. If you do not give permission, the Google tag is not loaded and this data is not collected. Details are in the advertising measurement section of the Cookie policy.

2.7. Data we do not collect

• Advertising or tracking cookies without your permission; third-party tracking scripts other than the permitted advertising measurement; usage telemetry (only error records are kept); advertising identifiers other than the ad click identifier and the random browser identifier used in permitted advertising measurement; device fingerprints.
• Location, screenshots, keyboard and mouse activity, activity status or online time.
• Card numbers or bank account details.
• The content and access tokens of a Gmail or Outlook account you connect on the Mail screen. These never reach our servers (section 8).

3. Cookies and similar technologies

The Site and the app keep the records they need to work in your browser’s local storage. The only use that is not necessary for the Service to work is Google Ads advertising measurement, which runs on the Site only with your permission. For this reason a cookie banner is shown when you first open the Site; you can manage advertising measurement with the “Accept all”, “Reject all” and “Manage preferences” options. You can change your decision at any time with the “Cookie preferences” link in the page footer. The name, purpose and duration of each record used are listed in the Cookie policy.

4. Purposes and legal bases of processing

Because Gmail and Outlook data on the Mail screen does not reach our servers, the legal bases in this table do not apply to that data (section 8).

4.1. Purposes for which we do not process data

• We do not process your personal data for marketing, advertising personalisation or behavioural analysis. The only exception is the advertising conversion measurement that runs on the Site only with your explicit consent.
• Loop does not send marketing emails and has no newsletter list. No emails are sent per task. Only the company owner and administrators receive a single email summarising the company’s work status at the frequency they choose (daily or weekly), and this summary can be turned off in the settings. Account verification and password reset messages are sent only when you start that process. When you are invited to a company, an invitation email is sent to you at the request of the person inviting you.

4.2. Performance screen

The performance screen is a report derived from task completion data on your company’s instructions and may include an assessment of work performance within the meaning of the GDPR. Your company is responsible for how the report is used in relation to employees, for informing employees about it and, where applicable, for obligations under employment law. Loop does not make any decision on its own on the basis of the report.

5. Transfers of personal data within Turkey

Under Article 8 of the KVKK, personal data is as a rule transferred with the explicit consent of the data subject. Explicit consent is not required where one of the conditions in the second paragraph of Article 5 of the Law applies (for example, where the transfer is expressly provided for by law, is necessary for the performance of a contract, is needed for the controller to fulfil a legal obligation, or is necessary for the establishment, exercise or protection of a right) and, for special categories of personal data, where the conditions in Article 6 of the Law apply.

Your personal data may be transferred within Turkey only in the following cases:

• To competent public authorities and institutions (for example courts and the Personal Data Protection Authority), where there is a legal obligation and upon a written and specific request, limited to the scope of that request (KVKK Art. 5/2-a and ç).
• Where necessary, to our financial and legal advisers, to the extent required to fulfil our legal obligations or to establish, exercise or protect a right (KVKK Art. 5/2-ç and e).

6. Transfers of personal data abroad

6.1. Routes provided for by law

Article 9 of the KVKK was amended by Law No. 7499, which entered into force on 1 June 2024. Under the current wording, personal data may be transferred abroad by one of the following routes:

1. Adequacy decision: If one of the processing conditions in Article 5 or 6 of the Law applies and the Personal Data Protection Board has issued an adequacy decision for the country, the sector within the country or the international organisation to which the data is transferred. 2. Appropriate safeguards: If there is no adequacy decision, one of the processing conditions applies, the data subject can also exercise their rights and seek effective legal remedies in the destination country, and the parties have provided one of the appropriate safeguards listed in the Law. These safeguards are an agreement between public bodies authorised by the Board, binding corporate rules approved by the Board, a standard contract announced by the Board and a written undertaking authorised by the Board. A standard contract is notified to the Personal Data Protection Authority within five business days of signature. 3. Incidental transfer: If there is neither an adequacy decision nor an appropriate safeguard, only for transfers that are not regular and not continuous and only where one of the cases listed in the Law applies. These cases include the data subject giving explicit consent to the transfer after being informed of the possible risks, and the transfer being necessary for the performance of a contract with the data subject.

The same rules apply to onward transfers of data transferred abroad to other countries.

As of the date of this policy, the Personal Data Protection Board has not issued an adequacy decision for any country. None of the transfers below therefore relies on an adequacy decision.

6.2. Recipients of the data

MercanWorks OÜ is established in Estonia, that is, in the European Union, and provides the Service with the providers below. For users in Turkey, transmission to these providers constitutes a transfer abroad.

Each provider’s own subprocessors (for example Amazon Web Services for Supabase) are listed in that provider’s own list. Your data is never sold or rented and is not transferred to data brokers.

The Personal Data Protection Board has not issued an adequacy decision for the countries where these providers are located. For users in Turkey, it is therefore not guaranteed that the level of protection and legal remedies available in Turkey will be provided in the same way in these countries. Information for users in the European Union is in 6.4.

6.3. Google Ads advertising measurement

If you allow advertising measurement on the Site, the data in 2.6 is sent to Google Ireland Limited (Ireland) and Google LLC (USA); Google may also process it on its servers in other countries. Google processes this data under its own terms and for its own purposes as an independent controller.

This transfer takes place only with your explicit consent; it does not happen if you do not give permission, and you can withdraw your permission at any time. For users in Turkey, you should know the following: the Board has not issued an adequacy decision for these countries; they may not offer protection and legal remedies equivalent to those in Turkey, public authorities there may access the data under their own law, and it may be harder for you to exercise your rights against Google.

How Google uses this data is explained on the page “How Google uses information from partner sites”. Google states that it removes part of the IP address from ad server logs after 9 months and cookie information after 18 months.

6.4. Users in the European Union

Your database and authentication data is stored within the European Union. The limited transfers outside the European Union are as follows: when you run the AI assistant, the text you write goes to OpenAI in the USA, and payment data goes to Stripe; the content of file attachments is stored on Cloudflare’s global network and may be processed outside the European Union; emails sent through Google Workspace and WhatsApp conversations may also be processed on servers outside the European Union. You can write to [email protected] for information about the safeguards applied to these transfers. For visitors in the European Economic Area, the advertising measurement data is received by Google Ireland Limited; Google states that it relies on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework when transferring the data to the USA.

6.5. Changes of providers

At least 30 days before a new processor is added or an existing one is replaced, the table in 6.2 is updated and the change is announced on this page. Your company may object within that period by writing to [email protected]; if the objection cannot be resolved, the company owner may close the company (if there is an active subscription, it is cancelled first).

With the update of [publication date], Google Workspace, which is used to send account verification, invitation and summary emails, was added to the table in 6.2. Your company may object to this change within 30 days of that date by writing to [email protected].

6.6. Connections made directly by your browser

When you use the Mail screen, your browser communicates directly with Google or Microsoft servers; this traffic does not pass through our servers and MercanWorks OÜ does not transfer this data. During payment you are redirected to Stripe’s payment page, which is subject to Stripe’s own policy. In these connections your IP address is technically visible to the provider concerned.

7. AI setup assistant

The “Describe it, I’ll set it up” assistant helps you set up your company’s task types, stages, fields, workflow steps, tasks, forms and automation rules from a description you write. The assistant runs only when you start it, does not run in the background on its own and does not read your data on its own. The language model is provided by OpenAI.

• Sent: The request text you write; the names of your company’s types, fields, stages, rules, projects and teams; the list of members’ names and roles so that the assistant can assign tasks. If you ask the assistant to find or update existing work, the number, title, stage, project, assignees and due date of the tasks matching that search are also sent.
• Not sent: Task descriptions, comments, project chat messages, file attachments, form responses, field values and confidential field values, mail content and payment information.
• Masking: The request text sent to OpenAI is not masked and everything you write is sent as it is, so we recommend that you do not include personal data in your request. Masking applies only when the conversation summary is saved: sequences of 10 or 11 digits (phone numbers, Turkish ID numbers and order numbers cannot be told apart because they have the same length) and email addresses are masked as the summary is written.
• Preview and approval: Everything the assistant intends to set up is first shown as a preview, and nothing is saved without your approval. The masked conversation summary is kept for 12 months for quality and abuse control and credit counting. We do not use your conversations or your company’s data to train any model. Under OpenAI’s API policy, inputs and outputs sent through the API are not used for model training by default, and OpenAI keeps these records for up to 30 days to monitor abuse.
• Credits: The assistant runs on AI credits; one credit is one round with the assistant. The Free plan has no AI credits, the assistant is disabled and no data is sent to OpenAI.
• No automated decisions: Loop makes no decisions about people on its own; the product contains no automated system that produces decisions with legal effects or similarly significant effects on a person. Your right to object under KVKK Art. 11/1-g and GDPR Art. 22 is reserved.

8. Mail (Gmail and Outlook) data

The Mail screen lets you read and reply to your own Gmail or Outlook and Microsoft 365 account from within Loop. The Mail screen is not shown if no provider is configured, and it does not work while you explore the sample company. The Gmail connection is currently not offered; the provisions of this section concerning Gmail apply if the connection is offered again.

In this section, the “Loop app” means the software running in your browser, and “our servers” means the servers operated by MercanWorks OÜ. Only the Loop app in your browser accesses your Gmail and Outlook data and processes it only there; our servers do not receive, store or see this data.

8.1. What it does

• Lists your inbox and displays messages.
• Lets you write replies and send new messages.
• Deletes messages (not permanently; a message can be restored from the provider’s deleted items folder), archives them and marks them as read or unread.
• Performs no other action in your account; it does not access your contacts, calendar, files or shared mailboxes.

8.2. Authorisation takes place in your browser

When you connect your account, you are redirected to Google’s or Microsoft’s own sign-in page and never enter your password in Loop. Authorisation is completed entirely in your browser with OAuth 2.0; there is no server component in between and tokens are not sent to our servers. The permissions requested are the narrowest scope needed for the actions in 8.1. If the scope changes, this page is updated and you are asked to authorise again on the provider’s consent screen. Because data on the Mail screen does not reach our servers, the legal bases in section 4 do not apply to it; the authorisation is a permission you give to Google or Microsoft and can be withdrawn at any time in the ways described in 8.5.

8.3. Permission scopes

• Google (Gmail): gmail.modify (reading mail; changing labels, deleted items and archive; sending; permanent deletion is outside this scope), openid and email (to show your account by its email address). Full Gmail access, contacts, calendar, Drive or any other Google service scope is not requested. With the Google connection, the access token is valid for about one hour, no refresh token is obtained and there is no permanent access.
• Microsoft (Outlook, Microsoft 365, Hotmail): Mail.ReadWrite (Loop uses only the reading, moving and marking parts of this permission; it moves messages to the deleted items folder and does not delete them permanently), Mail.Send (sending messages on your behalf), openid and email, offline_access (a refresh token so that the connection continues without signing in again each time). Because of this last permission, the Microsoft connection lasts until you remove it, revoke it in your Microsoft account or Microsoft invalidates the token. Mail.ReadWrite.All or shared mailbox permissions are not requested.

8.4. Data stays only on your device

Access and refresh tokens are kept in your browser’s local storage. Message content is processed in your browser’s memory and is not stored permanently on your device. Mail content and tokens are not sent to our servers, database, logs, the AI assistant or any other third party; the data moves only between your browser and Google’s or Microsoft’s servers, directly and encrypted. We cannot see, store or sell this data, we do not use it for advertising or model training, and it is not read by humans. The connection is tied to the device and browser: you need to connect your account again on another device, and the connection is lost if you clear your browser data.

8.5. Removing the connection and revoking access

When you remove the connection on the Mail screen, the tokens and account details are deleted from your device; there is no copy on our servers to delete. You can also revoke access on the third-party app permissions page of your Google account and in the app permissions section of your Microsoft account’s privacy settings.

8.6. Message body and remote images

The message body is displayed in an isolated frame that does not run scripts. Remote images in a message are loaded only in a separate, restricted frame; the image request goes directly from your browser to the sender’s server, which may see your IP address. Loop does not act as an intermediary for these requests.

9. Google API Services User Data Policy, Limited Use

Loop's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

This commitment applies to all data obtained from your Gmail account for the Mail screen and includes the following principles:

• Gmail data is used only to provide the user-facing Mail feature (reading, replying, sending, deleting, archiving, marking as read).
• It is not used to serve ads, target ads or measure ads.
• It is not read by humans. The only exceptions recognised by the policy are your explicit permission, review for security purposes and legal obligations; because the data does not reach our servers, none of these exceptions occurs in practice.
• It is not transferred or sold to third parties; the limited exception for remote images in 8.6 applies.
• It is not used to develop, improve or train generalised artificial intelligence or machine learning models.

We apply the same principles to mail data obtained from your Microsoft account.

10. Retention periods

Unless stated otherwise, the periods below are defined in code and applied automatically every night. When a period ends, the data is deleted.

The content of file attachments is kept in Cloudflare R2 and their metadata in the database; when a file is deleted, its content is deleted too. A file can be at most 25 MB. No data is stored on our servers for the Mail screen. You can export the task list and the performance report as CSV within the app; there is no download feature that archives the whole company at once.

11. Data security

We apply the measures below to protect your data against unauthorised access, loss and disclosure. Only measures the product applies today are listed here.

• Company separation: Each company sees only its own data; this rule is enforced at database level with row-level security and measured with live tests.
• Encrypted transmission: All connections are encrypted with TLS.
• Password: Exists only in hashed form at the authentication provider; there is no plain-text password anywhere.
• Confidential fields: Stored in a separate column and read only by authorised people through a single controlled path.
• Content security policy: No third-party script runs in the app. Permitted advertising measurement does not run inside the page but in a separate, restricted frame; secret keys are not sent to the browser.
• Mail: Message bodies are displayed in an isolated frame that does not run scripts, and tokens are not sent to the server.
• File integrity: The SHA-256 hash of each file attachment is verified on download; if it does not match, the file is not shown.
• Dependencies: The software components used are scanned regularly for known vulnerabilities.
• Data centre: The database is in the European Union. Providers’ security documentation is described in 11.1.
• Organisational measures: Access is limited on the principle of least privilege, no experiments are carried out on real data and test accounts are separate.

If you believe you have found a security vulnerability, you can report it to [email protected] with “security” in the subject line.

In the event of a breach affecting your company’s business data, we inform your company without undue delay; the obligation to notify the supervisory authority and the people concerned about this data lies with your company. For the account and subscription data for which we are the controller, notification is made within 72 hours at the latest to the Personal Data Protection Board under the KVKK and within 72 hours at the latest to the competent supervisory authority under the GDPR, and affected users are informed within a reasonable time.

11.1. Our providers’ security documentation

Our providers publish their security programmes and documentation on their own pages: Supabase, Cloudflare, Stripe, OpenAI, Firebase and Google Workspace. This documentation shows the provider’s level of information security and does not replace the legal transfer rules described in section 6. It belongs to the providers and does not mean that Loop or MercanWorks OÜ itself holds any certification.

Supabase →

Cloudflare →

Stripe →

OpenAI →

Firebase →

Google Workspace →

12. Links to other websites

The Site and the app contain links to pages of other organisations such as Google, Microsoft, Stripe and WhatsApp. These pages are subject to their owners’ privacy policies, and this policy does not cover the processing of data on them. We recommend that you read the relevant policies before visiting these pages. The “Chat with us on WhatsApp” button takes you to WhatsApp, and that conversation is also subject to WhatsApp’s privacy policy.

WhatsApp’s privacy policy →

13. Children’s data

Loop is a service designed for businesses and is not directed at children; we do not knowingly collect personal data from children. If you believe that a child’s personal data has been entered into the Service, you can write to [email protected]; your request will be handled under the procedure in section 14. Please note that your company is the controller of data about people contained in its business data.

14. Your rights

Under Article 11 of the KVKK and Articles 15 to 22 of the GDPR, you have the right to:

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of processing and whether the data is used in line with that purpose.
• Know the third parties to whom your data is transferred in Turkey or abroad.
• Request correction if the data is incomplete or inaccurate.
• Request erasure or destruction.
• Request that correction, erasure and destruction be notified to the third parties to whom the data was transferred.
• Object to a result against you arising solely from the analysis of your data by automated systems (Loop makes no such decision; section 7).
• Withdraw your consent at any time for processing based on explicit consent (advertising measurement, browser and phone notifications). You can withdraw your permission for advertising measurement with the “Cookie preferences” link in the page footer.
• Claim compensation if you suffer damage as a result of unlawful processing.
• Specifically under the GDPR: access (Art. 15), data portability (Art. 20; on request you receive a structured copy of the account data for which we are the controller), restriction of processing (Art. 18) and objection to processing based on legitimate interests (Art. 21).

You can carry out some actions yourself within the app: export your task and performance data as CSV, turn off browser or phone notifications, remove the mail connection, close the company as its owner and delete your account (Settings, Delete account).

14.1. Making a request

To exercise these rights, you can apply in writing from your registered email address to [email protected] or [email protected]; your identity is verified when you apply. Your request is answered free of charge within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. For data about people contained in your company’s business data, your company is the point of contact; we forward any such request we receive to the company concerned.

14.2. Right to lodge a complaint

If you are resident in the European Union, you can lodge a complaint with the supervisory authority of the member state where you live or work, or with our lead supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). If you are resident in Turkey, you can lodge a complaint with the Personal Data Protection Board if your request is rejected, the response is inadequate or you do not receive a response in time.

15. Changes to this policy

When this policy changes, the new version is published on this page with the update date at the top of the page. When a new data category, purpose, recipient or retention period is added to the product, this text is updated accordingly; changes of processors are subject to the 30-day advance notice rule in 6.5. This text is for information and does not require your consent. If a change introduces new processing based on explicit consent, your consent is requested separately and in advance.

16. Contact

For questions about this policy or your personal data, you can write to [email protected], and for general questions to [email protected]. Our postal address is: MercanWorks OÜ, Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Paavli tn 5a/1, 10412, Estonia.

KVKK privacy notice →

Cookie policy →

Terms of use →

Cancellation and refund policy →

Contact page →

Google API Services User Data Policy →

How Google uses information from partner sites →

Google account third-party app permissions →

Microsoft account app permissions →