Your family's data is yours.

1. Who we are

Playloop is the data controller for the personal data described here. You can reach us about anything privacy-related at hola@useplayloop.com. Our registered entity details and, where required, our EU representative under Article 27 GDPR will be listed here before launch.

2. What we collect

• Account data: first name and surname, email address, phone number, password (stored hashed, never in plain text), the community and neighbourhood you join, and your profile photo if you add one.
• Verification data: confirmation that your phone number and email are valid, and any community invite code you used.
• Listing and swap data: the toys you list, photos you upload, descriptions, point values, requests, completed swaps, points balance and reviews.
• Messages: messages you exchange with other families through the platform, and messages you send us.
• Location data: the neighbourhood you select. We do not collect precise GPS location or your home address; handover locations are agreed between families in messages.
• Payment data: if you subscribe to Premium, Stripe processes your card details. We never see or store full card numbers — we receive the subscription status, the last four digits, the card brand, and billing records for accounting.
• Technical data: IP address, device and browser type, and error logs needed to keep the service secure and working.
• Support and marketing data: what you send us through the contact form, and your newsletter subscription status if you opt in.

We don't ask for and don't want special category data — health, religion, ethnicity, political views. Please don't include it in listings or messages.

3. Why we use it, and our legal basis

We do not sell your personal data, and we do not use it for third-party advertising.

4. Who we share it with

• Other members: your first name, profile photo, neighbourhood, listings, reviews and the messages you send them. Your email address, phone number and surname are never shown to other members.
• Processors acting on our instructions: hosting and database providers, email delivery for transactional and newsletter email, error monitoring, and Stripe for payments. Each is bound by a data processing agreement and may only use the data to provide the service to us. The current list is available on request and will be published here before launch.
• Partner organisations: where a ludoteca, school or venue hosts a community, they may see aggregated, non-identifying figures such as how many families joined. They do not receive member contact details unless you give them separately at an event.
• Authorities: where we're legally required to disclose, or where it's necessary to protect someone's safety or establish and defend legal claims.
• A future buyer: if playloop is ever acquired or merged, member data may transfer as part of that. We'd tell you first and your rights would carry over.

5. International transfers

Playloop is operated by a US-registered entity and some of our service providers — including hosting, email delivery and Stripe — process data outside the European Economic Area, primarily in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified, together with additional technical measures such as encryption in transit and at rest. You can ask us for a copy of the safeguards in place.

6. How long we keep it

• Account data: for as long as your account is open, then deleted or anonymised within 30 days of closure.
• Listings and swap history: deleted or anonymised within 30 days of account closure. Reviews you left may remain in anonymised form so other families keep useful context.
• Messages: kept for 12 months after a conversation ends, or until account closure if sooner, so we can investigate disputes.
• Moderation and safety records: up to 3 years where needed to prevent a banned member returning or to defend a legal claim.
• Payment and invoicing records: retained for the period required by applicable tax and accounting law (ordinarily 6 years).
• Technical logs: up to 90 days.
• Newsletter data: until you unsubscribe, plus a minimal suppression record so we don't email you again by mistake.

7. Your GDPR rights

• Access: ask for a copy of the personal data we hold about you.
• Rectification: correct anything inaccurate or incomplete — most of it you can edit yourself in settings.
• Erasure: delete your account and data, subject to records we're legally required to keep.
• Restriction: ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Objection: object to processing based on our legitimate interests, including profiling for safety purposes.
• Withdraw consent: unsubscribe from marketing at any time via the link in any email or in settings. This doesn't affect processing carried out before you withdrew.

To exercise any of these, email hola@useplayloop.com or use the contact form. We respond within one month, and will tell you if we need longer for a complex request. We may need to verify your identity first. There is no charge.

8. Children's data

Playloop is intended for parents, guardians and caregivers aged 18 and over. Children may not create accounts and the service is not directed at children. We do not knowingly collect personal data from children.

We ask you not to include your child's name, date of birth, school, or identifiable photographs in listings, reviews or public content. Age ranges on listings refer to the toy's suitability, not to a specific child. If we become aware that we have collected personal data from or about a child without a proper basis, we delete it promptly. If you believe a child has provided us data, contact hola@useplayloop.com and we'll remove it.

9. Cookies and analytics

We use strictly necessary cookies for authentication, session management and security. These don't require consent under the ePrivacy Directive. We don't use advertising cookies, social media pixels or cross-site tracking.

If we later add analytics or any non-essential cookie, we will ask for your consent through a cookie banner before setting it, and update this section first.

10. How we protect it

We use TLS encryption in transit, encryption at rest, hashed and salted passwords, role-based access limited to team members who need it for support, and regular review of our providers. No system is perfectly secure, but if a breach ever affects your rights and freedoms, we'll notify the relevant supervisory authority within 72 hours and tell you without undue delay where required.

11. Automated decisions

We don't carry out automated decision-making producing legal or similarly significant effects. We may use automated checks to flag possible spam, duplicate accounts or unsafe listings, but a person makes the final call on removals and suspensions, and you can always ask for a human review.

12. Changes to this policy

We'll update this page when our practices change, and update the date at the top. If a change materially affects how we use your data, we'll email you at least 30 days before it takes effect.

13. Contact and complaints

Privacy questions, requests or concerns: hola@useplayloop.com. We'd always rather hear from you first.

You also have the right to complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos (AEPD, aepd.es); elsewhere in the EU you can complain to the authority where you live or work.

See also our Terms of Service and Trust & Safety page.

14. The launch waitlist

playloop isn't open yet. Until it is, the only thing most visitors share with us is a waitlist entry.

• What we collect: your email address, and optionally your first name and city. We also record which page you joined from, whether you ticked the consent box, and the date and time you ticked it — that timestamp is our record that you agreed.
• Why: to email you when playloop launches in your city, and occasional updates about getting ready for launch. Nothing else.
• Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking the box on the form. The box is never pre-ticked, and joining is never a condition of using this site.
• Who sees it: us, and the email and hosting providers listed in section 4. We never sell waitlist data or pass it to other companies for their own marketing — including the schools, groups and partners whose pages you may have joined from. Partners only ever see totals, never your details.
• How long we keep it: until you ask us to remove you, or 12 months after launch in your city if you never take up an account — whichever comes first. If you go on to create an account, your waitlist entry is folded into that account and section 6 applies instead.
• Getting removed: email hola@useplayloop.com and we'll delete your entry — no reason needed, no follow-up questions. Every email we send you also has a one-click unsubscribe link. Withdrawing consent doesn't affect anything we did before you withdrew it.