Last updated: October 6, 2026
Security and privacy are part of how Loopmark is meant to be used: keep sensitive marketing and customer data on your stack, bring your own keys, and minimise what leaves your environment.
Self-host first: run the agent where you already trust your controls. Bring your own keys: OpenAI and channel credentials stay with you. Least data on our website: we collect only what we need to operate the marketing site and respond to you.
HTTPS for transport encryption Dependency and platform updates for the static site Restricted access to deployment credentials Cookie consent before non-essential analytics No public storage of waitlist or contact data beyond operational need
When you deploy Loopmark you should: • Restrict network and admin access • Store API keys in secrets management, not in shared docs • Use HTTPS and secure cookies for any exposed UI • Apply OS and dependency patches • Set retention for leads, complaints, and logs • Limit who can publish or export customer data • Review third-party processor terms (OpenAI, Mailgun, Buffer, social platforms)
We align website practices with UK GDPR and PECR. See Privacy Policy and UK GDPR pages for lawful bases, rights, and ICO complaint routes. Self-hosting helps you keep personal data in jurisdictions and systems you choose, which can support transfer and residency requirements, subject to your own assessment.
If you believe there is a security issue with this website or the open-source project, email security@loopmark.com. Please avoid including unnecessary personal data in the report.
See also our Privacy Policy, UK GDPR page, and Cookies Policy, linked in the site footer.