Effective date: October 28, 2026
Tvara LLC (“Tvara,” “we,” “us,” or “our”) creates and operates ioLoop. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use ioLoop.
This Privacy Policy applies to the ioLoop website at
https://ioloop.com, the project editor at
https://studio.ioloop.com, signup and account services at
https://account.ioloop.com, the community at
https://community.ioloop.com, documentation at
https://docs.ioloop.com, and other ioLoop services that link to this Policy (collectively, the
“Services”).
This Policy does not govern:
- a website, application, or other project created by an ioLoop customer (“Customer Project”) when the customer determines how personal information is handled;
- a third-party service or integration that has its own privacy policy; or
- employment or contractor information.
For personal information collected through a Customer Project, the customer operating that project is ordinarily the business or controller, and Tvara processes the information on the customer’s behalf. Questions or rights requests about that information should first be directed to the operator of the Customer Project.
Our
Data Processing Addendum describes Tvara’s obligations when it processes Customer Personal Data on behalf of a customer.
The information we collect depends on how you use the Services.
We may collect your name, username, email address, phone number, company or organization, role, account identifiers, password or authentication information, preferences, selected age, and information about members, collaborators, and permissions. We may derive and store an approximate date of birth from the selected age. For users between 13 and 17, we also collect a parent or legal guardian email address and the user's confirmation that permission to create and use the account has been obtained.
We may collect billing name and contact information, company, billing address, country, postal code, tax-related information, subscription and plan details, invoices, purchases, credits, payment status, and transaction history.
Stripe processes payment-card information. We may receive a payment-method identifier, card brand, last four digits, expiration information, and payment status, but we do not receive or store the full card number entered directly into Stripe’s payment interface.
We collect information you create, upload, store, transmit, or generate through the Services, which may include:
- source code, server code, layouts, pages, workflows, project settings, and revision information;
- database schemas and records;
- files, images, media, assets, and backups;
- project users, access groups, permissions, and activity;
- published content, domains, and deployment information;
- data submitted by or about End Users of a Customer Project; and
- secrets, API keys, OAuth tokens, connection settings, and other information used to enable integrations.
Connection credentials and tokens are stored using protections intended for secret data, such as encryption where supported. You remain responsible for choosing appropriate integrations and permissions.
When you use AI-assisted features, we may collect prompts, instructions, code, files, project context, knowledge sources, conversation messages, model responses, tool calls and results, feedback, token or credit usage, and related logs.
We collect information you provide when you contact support, report abuse, submit feedback, participate in surveys, communicate with us, or post in the ioLoop community. Community posts and profile information you choose to make public may be visible to others.
Our servers may automatically collect IP address, browser and device type, operating system, referring page, pages or features requested, timestamps, request and response information, session and authentication events, error and diagnostic information, resource use, and security events.
We use this information to operate, secure, troubleshoot, and improve the Services and to enforce plan and resource limits. We do not currently use Google Analytics, Google Tag Manager, Meta/Facebook Pixel, or comparable advertising or behavioral-tracking tools.
We use cookies and similar technologies that are necessary for sign-in, authentication, security, session management, preferences, and core Service functionality. Disabling these technologies may prevent parts of the Services from working.
Our pages may load operational resources such as Google Fonts, Google reCAPTCHA, and Stripe.js. When a browser contacts those providers, they may receive request information such as IP address, browser details, referrer, and time of request under their own privacy terms. These resources are used for presentation, fraud and abuse prevention, and payments—not behavioral advertising by Tvara.
We collect personal information:
- directly from you;
- from a parent or legal guardian identified in connection with a user's account;
- from your organization, account administrator, or collaborators;
- automatically from your browser, device, and use of the Services;
- from End Users interacting with Customer Projects;
- from Stripe and other service providers;
- from integrations and third-party accounts you choose to connect; and
- from public sources when reasonably necessary for security, support, or legal compliance.
We use personal information to:
- create and administer accounts;
- determine account-age eligibility, notify a supplied parent or legal guardian address, and investigate reports that permission was not given or was withdrawn;
- provide, host, store, publish, and support Customer Projects;
- process subscriptions, payments, credits, invoices, and taxes;
- authenticate users and secure accounts, projects, and infrastructure;
- provide AI-assisted features and integrations requested by users;
- communicate about accounts, transactions, security, service changes, and support;
- send marketing communications where permitted and honor opt-out requests;
- monitor reliability, diagnose errors, allocate resources, and improve usability and performance;
- prevent, detect, and investigate fraud, abuse, security incidents, and violations of our Platform Rules;
- comply with law and enforce agreements; and
- create aggregated or de-identified information that does not reasonably identify an individual.
We may use aggregated or de-identified information for lawful purposes, including service planning, capacity management, security, and product improvement. We will not attempt to re-identify it except to test our de-identification methods or as permitted by law.
To provide an AI-assisted feature, we may send the information reasonably needed for your request—such as prompts, code, project context, files, knowledge sources, and tool results—to an AI service provider. For the ioLoop-managed code-generation assistant, Cloudflare AI Gateway currently routes this information to OpenAI and routes OpenAI’s output back to ioLoop. Cloudflare AI Gateway logs the prompts, outputs, and related request information it processes. It is configured to retain a rolling maximum of the most recent 100,000 requests, so the length of time a request remains in those logs depends on request volume rather than a fixed retention period.
Do not submit personal information or confidential material to an AI feature unless it is appropriate for the task and you have authority to do so. AI providers may process information under their agreements with Tvara or, for a connection using your own provider account, under your agreement with that provider.
Tvara does not use Customer Content to train generalized AI models. For ioLoop-managed OpenAI requests, Tvara has disabled model-feedback sharing, evaluation and fine-tuning data sharing, input and output sharing, and optional API call logging in its OpenAI organization. OpenAI may separately retain API content in abuse-monitoring logs for up to 30 days, unless a longer period is required by law or reasonably necessary to protect its services or others. We may use limited content and feedback to troubleshoot or improve an AI feature when you ask us to do so or otherwise authorize that use, but not to train a generalized model.
Customer-selected AI providers and any future ioLoop-managed AI providers have their own data-use practices. Depending on the provider, account type, and feature, a provider may retain inputs and outputs or use them to improve or train its systems. Tvara does not promise that every customer-selected or future provider prohibits those uses. Before using an AI feature, do not submit personal, confidential, or sensitive information unless you have authority to do so and the applicable provider’s practices are appropriate for your use.
We may disclose personal information as follows.
We use providers for infrastructure, content delivery, storage and backup, email delivery, payment processing, security, fraud prevention, customer support, and AI features. They may process information for us subject to contractual and legal restrictions. Our current list is available at
https://ioloop.com/sub-processors.
If you enable an integration or direct us to send information to another service, we disclose the information needed to fulfill your instruction. An OAuth integration may use an application registered by Tvara or, where supported, an OAuth application and client credentials you provide. We may process access and refresh tokens, approved scopes, connected-account identifiers, and information exchanged through the integration. Third-party services process that information under their own terms and privacy policies.
If you use an organization-managed account or collaborate on a project, administrators and other authorized users may access account activity and Customer Content consistent with their permissions.
Information you publish through a Customer Project or the ioLoop community may be visible to the public, other users, and search engines. When you share a project or invite a collaborator, the recipient can access the information covered by the permission you grant.
We may preserve or disclose information when we reasonably believe it is necessary to comply with law or legal process; protect the rights, safety, and property of Tvara, users, End Users, or others; investigate fraud, abuse, or security incidents; enforce our agreements; or respond to an emergency.
We may disclose information to advisors, potential transaction partners, or successors in connection with a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate confidentiality protections.
We may disclose information with your consent or at your direction.
Tvara does not sell personal information for money. We also do not share personal information for cross-context behavioral advertising and do not use advertising pixels or comparable behavioral-tracking technologies on the Services.
If our practices change, we will update this Policy and provide any legally required notice or choice before applying the change.
We retain personal information for as long as reasonably necessary to provide the Services, maintain security and business records, comply with legal, tax, accounting, and contractual obligations, resolve disputes, and enforce agreements.
Retention depends on the type of information and why we process it. For example:
- account and project information is generally retained while an account is active;
- billing and transaction records may be retained for legally required accounting and tax periods;
- security and diagnostic logs are retained for periods appropriate to their purpose;
- suspended or terminated accounts and project resources may be retained for a limited period before deletion; and
- backup copies may persist until they are overwritten under normal backup cycles.
We may retain information longer when required by law, subject to a legal hold, needed to prevent abuse, or necessary to protect legal rights. We may retain aggregated or de-identified information that no longer reasonably identifies an individual.
We use administrative, technical, and organizational safeguards designed to protect personal information. Measures may include access controls, encryption of certain sensitive records, network protections, backups, and monitoring.
No system is completely secure. You are responsible for protecting your credentials, configuring project permissions, securing your code and integrations, and maintaining appropriate backups. Notify us promptly if you believe an account or Customer Project has been compromised.
You may update certain account and billing information through the Services. You may unsubscribe from marketing emails using the link in the message. You may still receive transactional, security, billing, and service communications.
Depending on where you live and subject to legal exceptions, you may have rights to:
- know whether and how we process personal information;
- access or obtain a copy of personal information;
- correct inaccurate personal information;
- delete personal information;
- obtain portable information;
- object to or restrict certain processing;
- withdraw consent where processing is based on consent; and
- appeal a denied request or complain to a data-protection authority.
To submit a request, email
[email protected]. We may need to verify your identity and authority. An authorized agent may make a request where permitted by law, but we may require proof of authorization and identity.
If your request concerns information in a Customer Project, contact the project operator first. We will assist the operator as required by applicable law and our agreement with that customer.
We will not discriminate against you for exercising a privacy right.
This section supplements the rest of this Policy for California residents. Depending on how you use the Services, we may collect the following categories of personal information described by California law:
| Category | Examples | Sources and purposes |
|---|
| Identifiers | Name, username, email, phone number, postal address, IP address, account identifiers | From you, your organization, devices, integrations, and service providers; used to provide, secure, and support the Services |
| Customer-record information | Contact, account, and billing information | Used for accounts, support, billing, and compliance |
| Commercial information | Plans, purchases, invoices, credits, and transaction history | Used for billing, accounting, support, and fraud prevention |
| Internet or network activity | Logs, device and browser information, feature use, security events | Used for operation, security, diagnostics, and improvement |
| Approximate geolocation | Approximate location inferred from IP address | Used for security, fraud prevention, and regional operation |
| Professional information | Company, organization, role, and team membership | Used to administer accounts and collaboration |
| Audio, visual, or electronic information | Files, images, recordings, messages, and other content you provide | Used to provide requested features and support |
| Inferences | Security, abuse, or account-preference inferences derived from activity | Used for safety, fraud prevention, and service operation |
| Sensitive personal information | Account credentials and contents of certain communications; precise categories depend on what users submit | Used only for permitted operational purposes and not to infer characteristics |
We disclose these categories to the recipients and for the purposes described in Section 6. We do not sell them or share them for cross-context behavioral advertising.
California residents may have rights to know, access, correct, or delete personal information and to receive information about our collection and disclosure practices. Submit requests to
[email protected]. California’s “Shine the Light” law may also permit certain requests concerning disclosure for third parties’ direct-marketing purposes; we do not disclose personal information to third parties for their own direct marketing.
Tvara is based in the United States. ioLoop’s production servers are currently located in California, but information may be processed in the United States and in other countries where Tvara or its authorized service providers operate. Those countries may have data-protection laws that differ from those where you live.
Where required, we use an approved transfer mechanism or other legally recognized safeguard. The Data Processing Addendum includes transfer terms for Customer Personal Data. Users in the European Economic Area, United Kingdom, and similar jurisdictions may contact us for more information about applicable safeguards.
ioLoop accounts and platform-building services are not directed to children under 13, and a person under 13 may not create or use an ioLoop account. If you believe a child under 13 has provided personal information to us through an ioLoop account, contact
[email protected].
Users between 13 and 17 may create and use an ioLoop account only with permission from a parent or legal guardian. During signup, we require the user to provide a parent or legal guardian email address and confirm that permission has been obtained. We may send that address a notification identifying the account email and explaining how to report that permission was not given or has been withdrawn. We may suspend or close the account in response to such a report.
Customer Projects may be accessible to End Users under 18. The customer operating a Customer Project is ordinarily responsible for deciding whether the project is appropriate for minors and for complying with applicable child-safety, age-assurance, consent, and children's privacy laws. Customers may not use ioLoop to create or operate projects directed to children unless the Services and a written agreement with Tvara expressly support that use.
The Services may link to or integrate with services that Tvara does not control. This Policy does not govern their independent privacy practices. Review their privacy policies before providing information or enabling an integration.
We may update this Policy. We will post the updated version at
https://ioloop.com/privacy and revise the effective date. If a change is material, we will provide notice as required by law, such as by email or through the Services.
For privacy questions or requests, contact:
Tvara LLCCreator and operator of ioLoop
5480 Sunol Blvd, Ste 2
Pleasanton, CA 94566
Email:
[email protected]Website:
https://ioloop.com 