What Loomis keeps, and what it doesn’t.
You’re trusting Loomis with personal information. Here’s how it’s handled.
What Loomis reads.
Plus any account you connect yourself. Private messages are skipped, even then.
Loomis refuses to get past a login wall or use data bought from a broker.
How it’s protected.
Your connection to Loomis runs over TLS, so nobody in between can read it.
A connection token is encrypted before it’s stored, with the key kept elsewhere, and never shows up in a log or your browser. Accounts connected through Bundle Social keep their tokens with Bundle Social.
Servers and the database run on Amazon Web Services in Ireland. Reports, CVs and exports are stored encrypted in Cape Town, closed to the public internet.
How it’s deleted.
What Loomis gathers is deleted automatically when its retention period ends.
Loomis stops reading that account. What it already found follows the retention period.
Your findings, the evidence and your account go for good. What stays: payment records the law requires, without your name, and a record of your request and what was done.
With or without an account, or on someone’s behalf, through a data rights request.
When an organisation checks someone.
Every organisation signs up to check only adults, for a lawful business purpose, and each check names its purpose.
Public sources only, never the person’s logins or messages. Every finding links to the posts behind it.
Special personal information, such as health, religion or political views, is removed from every report.
Loomis refuses any request for an automated decision about someone. The organisation’s team makes the call.
Reports go to that organisation and the address it chooses. Webhooks carry a check’s status, never its findings, and everything is deleted on the organisation’s schedule.
The organisation decides who is checked and why. Under POPIA, South Africa’s privacy law, Loomis acts as its Operator.
The full detail is in the privacy policy. To see, correct or delete your data, send a data rights request.