Privacy policy
Your data, in plain English
What we collect on adaptl.ai and in the Inloop app, why, who helps us process it, how long we keep it, and how to make us change or delete it.
The short version
- We collect what we need to run Inloop: your sign-in details, your team, and the projects and changes you work on.
- We never sell your data or use it for advertising.
- Usage analytics in the Inloop app is off until you turn it on, and never includes your name, email, projects or anything you type.
- Inloop's servers are in the EU (Stockholm, Sweden).
- You can ask us at any time what we hold about you, for a copy, or to delete it.
Who we are
Adaptl, based in the Netherlands (registration no. 42162373), is the data controller for adaptl.ai and the Inloop app (inloop.adaptl.ai). Questions and requests: privacy@adaptl.ai. Our supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
When your team brings its own product into Inloop, any personal data inside that product (in its code, pull requests or test data) belongs to your team. For that data we act as your processor, on your instructions.
On adaptl.ai
- Visit counts (Google Analytics). We count visits and see which pages help, using Google Analytics cookies (
_ga,_ga_*). Advertising features are off. Turn it off any time with Cookie settings at the bottom of every page; we then delete those cookies. - Help requests. If you ask us for a hand getting started, we receive your work email through Formspree and use it only to reply to you.
- Support chat (SimplyBoost): the chat bubble on adaptl.ai is run by SimplyBoost. What you type into it, and the technical details your browser sends when the bubble loads, go to SimplyBoost so we can answer you. Don't type passwords or keys into it.
In the Inloop app
- Your account: your email, display name, and, if you sign in with GitHub, your GitHub user id and username. If you have a password, we keep only a bcrypt hash of it.
- Signing in: a session cookie that lasts 14 days. To stop password guessing we record sign-in attempts as keyed hashes, never your email in plain text.
- Your team's work: team and project names, changes, ideas, comments, feedback pins and decisions, and the names of guests your team invites to review a change.
- GitHub: through Inloop's GitHub App, the repositories, pull requests and issues your team connects. Access tokens are stored encrypted.
- AI features: to write summaries, review ideas and fix feedback, Inloop sends the relevant text and code of a change to an AI provider: Anthropic, or whichever provider your team sets up with its own key. Your team's key is stored encrypted.
- Previews: when your team starts a cloud preview, Inloop runs your project's code on a private server for your team, filled with made-up test people, not real customers.
- Error reports (Sentry): when something breaks, we receive the technical details of the error. Cookies, passwords, request contents, IP addresses and email addresses are removed before it is sent.
- Usage analytics (Google Analytics), only if you say yes: which screens you open (Work, a change, Lineage, Settings), how long your session lasts, an anonymous visitor id kept in a cookie (
_ga,_ga_*) on the app's own address, your browser, operating system, language and rough location. Never your name, email, team, projects, links, page addresses or anything you type; advertising features are off and Google does not store your IP address. Change your answer any time in Settings → Help improve Inloop; no deletes those cookies. - Feedback to Adaptl: when you use Feedback in the app, we receive what you type, the kind of message and the screen you were on, with your display name, so we can improve Adaptl and tell you how it's going. Nothing else from your team or projects goes with it. Erasing your account erases what you sent.
Why we may use it (legal basis)
| What | Legal basis (GDPR Art. 6) |
|---|---|
| Your account, signing in, your team's work, GitHub, AI features, previews | Contract: we need it to provide Inloop |
| Support chat, feedback to Adaptl | Legitimate interest: answering your questions and improving Adaptl |
| Sign-in attempt records, error reports | Legitimate interest: keeping Inloop secure and working |
| Usage analytics in the app | Your consent, which you can withdraw in Settings |
| Visit counts on adaptl.ai | Legitimate interest in knowing which pages help; opt out with Cookie settings |
| Help requests | Steps you asked us to take before a contract |
Who helps us (processors)
| Service | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting the app, database and previews | EU (Stockholm, Sweden) |
| GitHub | Sign-in and your team's repositories | United States |
| Anthropic | AI features, unless your team uses its own provider | United States |
| Sentry | Error reports | EU (Germany) |
| Google Analytics | Visit counts on adaptl.ai, and usage analytics in the app only with your yes | EU and United States |
| SimplyBoost | Support chat on adaptl.ai | Not yet confirmed |
| Formspree | Help request form | United States |
| ImprovMX | Forwarding email sent to @adaptl.ai | EU and United States |
Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account and your team's work: until you delete them, or ask us to.
- Sessions: 14 days. Guest review links and team invites: until they expire or are withdrawn.
- Error reports: at most 90 days.
- Usage analytics: at most 12 months.
- Help requests: until our conversation ends, and at most 12 months.
Your rights
You can ask us to show you, correct, delete or hand over (in a machine-readable file) the personal data we hold about you, to restrict or object to how we use it, and to withdraw consent at any time. Email privacy@adaptl.ai and we will answer within one month. Deleting your account removes your login and every team you alone own, with everything in it. If you are unhappy with our answer, you can complain to the Autoriteit Persoonsgegevens or the authority where you live.
How we protect it
Everything travels over HTTPS. Each team's data is kept apart in the database itself, so one team can never read another's. Passwords are hashed, and tokens and keys are encrypted. Code from outside your own repository never runs without your explicit yes.
Changes to this policy
If we change what we collect or why, we update this page and its date. If a change matters to you, for example a new kind of data or a new processor, we tell you in the app before it applies.