Privacy policy
Last updated October 6, 2026
This policy explains what information LossLoops collects, why, who else handles it, how long we keep it and the choices you have. LossLoops is operated by Hit Select in Utah, USA (“we”, “us”). Questions go to info@hitselectagency.com.
Who this covers
LossLoops is a reporting tool used by marketing agencies on behalf of the businesses they serve. That means three groups of people:
- Agency users who sign in to LossLoops. For their account information, we decide how it's used.
- Business owners an agency invites to view their own reports.
- The businesses' own customers and leads, whose details appear in data an agency connects or uploads. For this data we act as a service provider (a “processor”) for the agency: we use it only to produce that agency's reports, on its instructions.
What we collect
Account information
Name, email address, a hash of your password (never the password itself), two-factor authentication settings, passkeys, your agency and role, and billing details. Card numbers are handled by Stripe and never reach our servers.
Data from connected services
When an agency connects a service, we read the following, read-only:
| Service | What we read |
|---|---|
| Google Search Console | Search performance: queries, clicks, impressions, click-through rate and average position |
| Google Analytics 4 | Aggregated reports: sessions, engagement and conversions by device, landing page and channel |
| Google Ads | Campaign reporting: spend, clicks, conversions and impression share |
| Google Business Profile | Performance metrics: calls, website clicks, direction requests and reviews |
| Meta Ads | Ad insights: spend and results by campaign |
| HighLevel | Contacts, opportunities and their stages, and conversation activity (when a lead was contacted) |
| CallRail | Call records: time, duration, answered or missed, and the marketing source |
We store the access tokens these services issue, encrypted, so we can refresh reports. We never request permission to post, edit campaigns, send messages or change anything in a connected account.
Uploaded data
CSV exports an agency uploads, typically leads and sales: names, phone numbers, email addresses, statuses, dates and deal values.
Usage and technical data
IP address, browser type, pages requested, timestamps and error reports, used to keep the service secure and working. We use only cookies that are needed for sign-in, security and remembering display preferences such as light or dark mode. We don't use advertising or cross-site tracking cookies, and this website sets no cookies at all.
How we use it
- To produce each agency's reports: rebuilding customer journeys, measuring each stage and ranking fixes.
- To run accounts: sign-in, security alerts, invitations, billing and support.
- To keep the service secure: detecting abuse, investigating incidents and meeting legal obligations.
- To improve LossLoops, using aggregated, de-identified usage information only.
AI explanations. Reports include plain-language explanations written by an AI model. We send the model the report's computed results, such as stage rates and the value of each fix, not raw lead records. The provider processes it only to return the explanation and does not use it to train its models.
We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.
Google user data
LossLoops' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- Google user data is used only to provide and improve the reporting features the agency can see in LossLoops.
- It is not transferred to others except as needed to provide those features, to comply with law, for security, or as part of a merger or acquisition with notice to you.
- It is never used or transferred for advertising, including retargeting or personalized ads, and never sold.
- No person reads it unless you give specific permission, it's needed for security or legal reasons, or it has been aggregated and anonymized for internal operations.
- It is not used to develop, improve or train generalized AI or machine-learning models.
Who else handles data
We use these service providers, each bound by a contract to protect the data and use it only to serve us:
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Application hosting | United States |
| Neon | Database | United States |
| Google Cloud | Encryption key management | United States |
| Stripe | Payments and invoicing | United States |
| Resend | Account and notification email | United States |
| Sentry | Error monitoring, with personal data scrubbed | United States |
| Upstash | Rate limiting | United States |
| Cloudflare | Bot protection on sign-in (Turnstile) | United States |
| Anthropic | AI-written report explanations | United States |
We may also disclose information when required by law, to protect someone's safety, or to a successor if LossLoops is sold or merged, in which case this policy continues to apply.
How long we keep it
| Data | Kept until |
|---|---|
| Access tokens for a connected service | Deleted, and revoked with the provider where it allows, as soon as the service is disconnected |
| A client business's data | Deleted when the agency deletes that client |
| An agency's account and all its data | Read-only for 30 days after the subscription ends, then deleted within the following 30 days |
| Server logs and error reports | 30 days |
| Security audit records (sign-ins, permission changes) | 1 year |
| Invoices and payment records | As long as tax law requires, usually 7 years |
| Database backups | Deleted data can remain in encrypted backups for up to 30 days, then is overwritten |
Your choices and rights
You can ask us to tell you what personal information we hold about you, correct it, export it, or delete it. Agency admins can do most of this directly in LossLoops. Otherwise email info@hitselectagency.com. We'll verify the request and respond within 30 days, and we won't treat you differently for exercising these rights.
If you are a customer or lead of a business that uses LossLoops through its agency, that business controls your data. Contact the business first. If you contact us, we'll pass your request to them and help them fulfill it.
You can disconnect Google, Meta, HighLevel or CallRail from LossLoops at any time, and also revoke access from each service's own settings, for example at myaccount.google.com/permissions. How deletion works is described on our data deletion page.
Security
Each agency's data is isolated at the database level, encrypted in transit and at rest, and access tokens get a second layer of encryption. Accounts support two-factor authentication and passkeys. See our security overview. If we learn of a breach affecting your information, we will notify you and the relevant authorities as the law requires.
Children
LossLoops is a business tool and isn't directed to anyone under 16. We don't knowingly collect personal information from children.
Where data is processed
LossLoops stores and processes data in the United States. If you use it from elsewhere, your information will be transferred to the United States.
Changes to this policy
We'll post any change here and update the date at the top. If a change materially affects how we use personal information, we'll email agency admins at least 30 days before it takes effect.
Contact
Hit Select, Utah, USA. info@hitselectagency.com