Loomigrate Privacy Policy
Draft version. This document describes how the service actually operates. The entity's details and some of the legal clauses will be supplemented following the company's registration and a legal review — until then, it applies to the extent described below.
1. DATA CONTROLLER
The details of the entity operating the Loomigrate service (name, registered office, tax identification number (NIP)) will be provided once the company's registration has been completed. Contact in data protection matters: info@loomigrate.com.
2. SCOPE AND PURPOSE OF PROCESSING
Loomigrate is a tool for migrating mail, calendars, contacts and files between systems (Google Workspace, Microsoft 365, IMAP/POP3/CalDAV/CardDAV servers, Dropbox, Box, PST archives). We process two categories of data:
a) Customer account and billing data — the email address and details of the persons managing the account, the organisation's name, invoicing details, and the history of migration projects (statuses, numbers of transferred items, error messages). We retain this data for the duration of the agreement.
b) The content of migrated data (messages, events, contacts, files) — this is data of our customer's employees or clients. In this respect, Loomigrate acts solely as a processor, acting on behalf of the customer, who remains the controller of this data.
3. HOW THE CONTENT OF MIGRATED DATA IS PROCESSED
By default, we transfer data "on the fly", without permanently storing the content on our servers:
- Mail (IMAP, Gmail API, Microsoft Graph): the service connects simultaneously to the source and target mailboxes and transfers messages directly between them.
- Calendars and contacts via the native Google and Microsoft APIs: an individual item is retrieved into memory, transformed and immediately written on the target side.
- Files (Google Drive, OneDrive, SharePoint, shared drives, Dropbox, Box): the content of an individual file is held briefly in working memory for the duration of the transfer and is released immediately after the transfer is completed.
Exceptions where writing to disk is technically necessary:
- Import of PST archives: an uploaded .pst file is stored on the working server until the account or project to which it belongs is deleted, which allows it to be re-imported without being uploaded again. An unpacked copy of the messages is created only for the duration of the import and is deleted after each run, regardless of its outcome.
- Synchronisation of calendars and contacts via CalDAV/CardDAV: the synchronisation tool uses a local working directory; the synchronisation state needed to catch up on changes later is stored in it.
To enable interrupted migrations to be resumed and resynchronisations to be performed, we store the technical state of the migration (e.g. identifiers of items already transferred) — without the content of messages and files. We delete this state together with the account or project.
Access credentials (passwords, OAuth tokens, service account and application keys) stored in the database are encrypted at rest with a separate key. For the duration of an individual task, they may be temporarily passed to the migration process.
In cloud mode, connections to the customer's servers originate from the fixed IP address 85.89.161.251. In agent (on-premise) mode, the migration runs entirely within the customer's network, and the content of the data does not reach Loomigrate's servers.
4. RETENTION PERIODS
Account data, project history and migration logs: for the duration of the agreement and thereafter for the period required by accounting and billing regulations and for handling any complaints — the specific period will be stated following consultation with accounting.
Content of migrated data: not stored permanently, except for the exceptions described in section 3 (uploaded PST files and synchronisation state — until the account or project is deleted).
5. DATA RECIPIENTS
Loomigrate connects directly to the source and target systems specified by the customer (including Google, Microsoft, Dropbox, Box and the customer's mail servers) solely to the extent and for the time necessary to perform the commissioned migration, on the basis of the credentials provided by the customer. Payments are handled by the operator Stripe. The list of other processors (e.g. infrastructure providers) will be supplemented.
6. DATA PROCESSING AGREEMENT (DPA)
Customers migrating the data of their employees or users enter into a data processing agreement (DPA) with us in accordance with Article 28 GDPR. To conclude one, please contact: info@loomigrate.com.
7. RIGHTS OF DATA SUBJECTS
Data subjects have the rights arising under the GDPR, including the right of access to their data, rectification, erasure, restriction of processing, data portability, the right to object and the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). With regard to data migrated on behalf of a customer, please contact that customer first, as the data controller.
8. COOKIES AND WEBSITE STATISTICS
The loomigrate.com website and the application panel (app.loomigrate.com) use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) only after consent is given in the cookie banner (Article 6(1)(a) GDPR). Before consent, the Google Analytics script is not loaded and no analytics cookies are stored. We do not use advertising cookies or ad personalisation.
After consent, visit data is collected: a pseudonymous browser identifier (_ga cookies), the pages visited (without address parameters), clicks on contact links and links to the panel, the device and browser type, and approximate location (country, city). In the panel we also record actions: registration and login, project creation (source and target systems, modules), adding accounts (count), connection tests (result), starting migrations (number of jobs, cost in credits), credit purchases (amount, currency, VAT treatment, country and customer type) and errors (which action failed). We do not send Google e-mail addresses, names, logins, project or file names, or any content of migrated data. Google Analytics 4 does not store IP addresses. Statistical data is kept for up to 14 months. Google may process data in the United States under the EU-US Data Privacy Framework.
Consent given on the website also applies in the panel, and vice versa. It can be withdrawn at any time with the "Cookie settings" link in the website footer or in the account settings of the panel, which deletes the Google Analytics cookies. The choice (consent or refusal) is remembered in the loomigrate_consent cookie on the loomigrate.com domain and in the browser's storage (localStorage). Apart from that, the panel stores only settings (language, theme) and login session data in the browser.