Legal
Privacy Policy
Last updated: 18 October 2026
Who we are
TwelveLoop ("we", "us") is the trading name of Two Tapers AB, a company registered in Sweden (org. no. 559534-0133), and operates twelveloopai.com and the Monthly Loop training platform at training.twelveloopai.com. For any question about this policy or your data, email hey@twelveloopai.com.
Our role with your data
When a company signs up for the Monthly Loop and enrolls its own team, we act on that company's instructions for its employees' data, the company is the data controller for that data, and we are the data processor. This policy explains what we do with that data and the safeguards in place; the company itself is responsible for its own basis for enrolling its employees.
What we collect
From the person who signs a company up (the admin): company name, first name, email address and phone number. From each employee who joins: first name and email address. For each person, we also save the language they chose to read a Loop in, once they finish it. No payment card details ever pass through our own systems, those go directly to Stripe. We also keep the number of seats a company chooses at signup. If someone tries to join a company that has no free seats, we record that the attempt happened, using a one-way hash of their email address instead of the address itself, so we can tell that company's admin that more seats may be needed. This record is kept for the life of the subscription, like the rest of the account data.
Why we collect it, and our legal basis
Admin data is collected to create and run the account, communicate about it, and bill for the subscription, our basis is performance of a contract with the admin. Employee data is collected and used solely to deliver each month's Loop and track that employee's own completion and quiz results, on the instructions of their employer.
Who processes your data
Two processors, both hosted in the EU: Supabase, which stores account and Loop data encrypted at rest, and Resend, which sends emails. Neither is authorized to use your data for its own purposes.
Data processing agreement
Our obligations as processor of employee data are set out in the Data Processing Addendum included in our Terms of Service, which forms part of the contract accepted at signup.
How long we keep it
Admin and employee data is kept for the life of the subscription, then deleted within 30 days of cancellation or non-renewal. Billing records we are required to keep longer under Swedish accounting law (currently seven years) are retained separately, only for that purpose.
If an individual employee wants their data deleted
You can ask us directly. Since your employer controls that data, we will let them know a request came in and give them five business days to raise an objection, for example, an active access dispute. If we do not hear back, or they confirm, we delete your record.
Cookies
On twelveloopai.com, we use essential cookies needed for the site to function, and optional analytics cookies to understand site usage, these only load if you accept them in the cookie banner, and you can decline or change your choice at any time. The Monthly Loop platform (training.twelveloopai.com) uses only essential cookies to keep you signed in to your personal Loop link, and does not use analytics or tracking cookies.
Your rights
Under GDPR you have the right to access the data we hold about you, to correct it, to have it deleted, to restrict or object to processing, and to receive a copy in a portable format. To exercise any of these rights, email hey@twelveloopai.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Changes to this policy
If we change how we handle personal data, we will update this page and adjust the date below.