Draft for legal review — not yet in effect.
This is a working draft prepared for review by counsel during the private beta. Placeholders in [brackets] are not yet decided.
Privacy Policy
Effective date: [EFFECTIVE DATE]
This policy explains how [COMPANY LEGAL NAME], of [REGISTERED ADDRESS] ("MRRLoop", "we", "us"), handles personal data when you use the MRRLoop website at `mrrloop.net` and the MRRLoop app at `app.mrrloop.net`. Contact: [CONTACT EMAIL — e.g. hello@mrrloop.net]. [DATA PROTECTION OFFICER / EU AND UK REPRESENTATIVE — if required.]
MRRLoop is in a private beta: you can only sign in with an email address we have invited, and some features (billing, live revenue verification, the live AI coach) are switched off or run in a labelled demo mode. This policy already describes those features so that it stays accurate when they are enabled; each one says when it applies.
1. Our approach
- Private by default. Your revenue amounts are visible only to you. Other members only ever see a tier label (for example "$1k+") and a trust badge, and only if your project visibility allows it. MRRLoop administrators do not see amounts.
- Minimal collection. We collect what we need to run the growth loop and keep it safe.
- No selling. We do not sell your personal data or use it for advertising.
2. Data we collect
- Invitation data: the email address we invited, who invited you and when, a short note about why (for example "founding helper, introduced by …"), and whether and when the invitation was used or withdrawn.
- Account data: email address, handle, display name, timezone, onboarding answers, and sign-in records.
- Project and growth data: projects, stage, weekly plans, reflections, quests, experiments and progress.
- Community data: collaboration requests, rooms, messages, files you upload, reports and blocks you make, and testimonials you agree to publish.
- Reputation data: XP events, opt-in league standings, and your public Passport (which shows tiers and badges, never amounts).
- Revenue data (optional, not offered during the private beta): if you connect a source such as Stripe or RevenueCat, we read monthly totals (subscription and price totals, paid invoices, charges and refunds if you allow it), counts of active subscriptions and paying customers, and your provider account id and business name. We never read your customers' names, emails or other personal data, or card, bank or payout details. Self-reported revenue you type in is stored and labelled as self-reported.
- AI coach data: your questions to the coach, its replies, and the coach memory notes you can view and edit.
- Billing data (later): when paid plans launch, the merchant of record collects payment details; we receive only plan, status and subscription identifiers.
- Technical and security data: a one-way hash of your IP address (we do not store the raw IP), rate-limit counters, bot-check results, audit log entries for sensitive actions, and error diagnostics.
- Product analytics: in-app events (for example "plan accepted") stored in our own database.
- Access-gate data (private beta): while the app sits behind our hosting provider's access protection, the provider (Vercel) processes your sign-in to that gate and sets its own cookie (see our Cookie Notice).
3. Why we use it, and legal bases
[Legal bases to be confirmed by counsel for each applicable law, including Egypt PDPL Law 151/2020 and GDPR/UK GDPR.]
| Purpose | Data | Proposed legal basis |
|---|---|---|
| Run the private beta (invitations, access) | Invitation, account, access-gate | Legitimate interests / pre-contract steps [TBD] |
| Provide the Service (plans, matching, rooms, Passport) | Account, project, community, reputation | Contract |
| Connect and verify revenue (when offered) | Revenue data | Consent (versioned; you can withdraw by disconnecting) |
| AI coach (when enabled) | Coach data, project context | Contract / consent [TBD] |
| Safety, moderation, anti-fraud, abuse prevention | Community, reputation, technical | Legitimate interests |
| Improve the product (aggregated analytics) | Product analytics | Legitimate interests |
| Billing (when enabled) | Billing data | Contract; legal obligation (tax) |
| Service emails (sign-in links and codes, invitations, notices) | Email address | Contract / legitimate interests |
Analytics reports our team sees are aggregated, exclude staff, and hide any group smaller than 5 members.
4. AI coach
The coach currently runs in demo mode and is labelled as such; demo replies are generated inside MRRLoop and are not sent to any AI provider. If we enable the live coach, your question and relevant project context (for example stage, plan and goals — and revenue tier or totals only if you include them) will be sent to Anthropic to generate a reply. Usage is limited by daily and monthly budgets. You can view, edit and delete your coach memory. Coach output is automated and is not professional advice. [TBD — confirm Anthropic's data-use and retention terms for the API account used.]
5. Who we share data with
Other members see what you choose to share in rooms and on your Passport. They never see your revenue amounts.
Service providers (subprocessors). Regions are the ones we have chosen for the private beta; not all providers are active yet.
| Provider | Purpose | When | Region |
|---|---|---|---|
| Supabase | Database, authentication, file storage, realtime | Always | EU — `eu-central-1` (Frankfurt, Germany) |
| Vercel | Hosting and delivery of the website and app; access protection during the beta | Always | Functions in `fra1` (Frankfurt, Germany); Vercel's global edge network delivers static assets and terminates TLS worldwide [TBD — confirm edge/log locations with counsel] |
| Cloudflare (Turnstile) | Bot protection on sign-in | Always | Cloudflare global network [REGION TBD — Cloudflare is a US company; EU data-localisation options to confirm] |
| Resend | Sending service emails (sign-in links/codes, invitations, notices) | Once enabled | [REGION TBD — Resend is a US-based company; whether an EU sending region is available/used is unknown and must be confirmed] |
| Sentry | Error monitoring (scrubbed reports) | Once enabled | EU region (Sentry's EU data residency, chosen at org creation) |
| Anthropic | AI coach replies | Only when the live coach is enabled | United States [TBD — Anthropic API data-use and retention terms] |
| Stripe / RevenueCat | Reading revenue totals | Only when you connect them (not during the private beta) | Provider's region |
| [MERCHANT OF RECORD] | Payments, tax, invoices | Only when billing launches | [REGION TBD] |
We may also disclose data when required by law, or to protect members and the Service.
6. International transfers
Our providers may process data outside your country, including in the European Union and the United States. [TBD — transfer mechanisms (for example Standard Contractual Clauses / UK IDTA) and Egypt PDPL cross-border requirements to be confirmed by counsel; providers above marked with a US region or unknown region need a transfer basis.]
7. How long we keep data
| Data | Retention |
|---|---|
| Invitation records | While the private beta runs; invitation rows for people who never joined are deleted [TBD — e.g. 90 days] after withdrawal or the end of the beta |
| Account and member content | Until you delete your account; deletion removes member-owned rows permanently |
| Revenue monthly totals | While the source is connected, up to 36 months. Disconnecting deletes your key and synced totals immediately; earned milestone stamps stay as history |
| Uploaded room files | Deleted files are purged from storage on the next cleanup run (about every 15 minutes); files hidden by moderation are purged after 30 days |
| Rate-limit counters | Dropped after about 1 day idle |
| Audit log | Kept for security; your account link is removed when you delete your account. Period: [TBD] |
| Product analytics events | [TBD] |
| Coach conversations | Until you delete them or your account. [TBD — fixed period] |
| Reports and moderation records | [TBD] |
| Backups | [TBD — per hosting provider and plan; during the beta the database plan may have no automated backups] |
| Billing records (once live) | As required by tax law: [TBD] |
8. Security
- Row-level security on every database table, deny by default.
- Revenue connection keys are envelope-encrypted and accepted only if read-only.
- IP addresses are stored only as salted one-way hashes.
- Rate limits and bot checks on sign-in and sensitive actions.
- Audit logging of sensitive admin and account actions; admins cannot see revenue amounts.
- Secrets are kept server-side and never sent to your browser.
- During the private beta the app is additionally behind an access gate and is excluded from search engines.
No system is perfectly secure. If a breach affects you, we will notify you and regulators as the law requires.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, export or restrict use of your data, to object, and to withdraw consent. You can:
- Export your data in You → Privacy (a machine-readable file).
- Delete your account in You → Privacy. This is permanent.
- Disconnect a revenue source at any time, which deletes its key and synced totals.
- Edit or delete coach memory, and withdraw testimonial consent.
- Ask us to withdraw an invitation you have not used.
- Email [CONTACT EMAIL — e.g. hello@mrrloop.net] for anything else. You may also complain to your data protection authority.
10. Children
MRRLoop is not for anyone under [MINIMUM AGE — proposed 18]. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.
11. Changes
We will post changes here and tell you in the app or by email before material changes take effect.