Advocate Loop

Privacy Policy

Last updated: May 25, 2026

In plain English

We collect the minimum data needed to run your referral program. We don’t sell or rent your data. We don’t use your data or your customers’ data to train AI models. Each business’s data is isolated from every other business’s on the platform. You can export or delete your data at any time. If we ever suffer a breach, we’ll tell you within 72 hours.

If you want the full details, keep reading. If you have questions, email privacy@advocateloop.com.

1. Who we are

This Privacy Policy describes how Advocate Loop LLC, a Pennsylvania limited liability company (“Advocate Loop,” “we,” “us,” or “our”), collects, uses, and shares information about you when you use our referral program platform (the “Service”).

When you sign up for an Advocate Loop account, you become a “Customer.” Your customers (advocates and referees who interact with your widget and emails) are referred to as “End Users.” This policy describes how we handle data for both Customers and End Users, as well as data we collect from visitors to our marketing site at advocateloop.com.

2. Information we collect

From visitors to our marketing site

When you visit advocateloop.com without an account, we collect:

  • Usage data, with consent: if you accept our analytics cookies, we record pages you view, links you click, your approximate location (country/region), browser type, and the campaign or referrer that brought you to our site (e.g. UTM parameters)
  • Consent state: whether you accepted or declined analytics, stored as a single value in your browser’s local storage
  • Anonymous identifier: if you accept analytics, we generate a random ID that ties your activity to a single anonymous profile (not linked to a name or email unless you later create an account)

If you decline analytics, we do not record any of the above. We also do not record any of it before you make a choice — you can browse the entire marketing site without any tracking events firing.

From Customers (you, the business)

When you create an account or use the Service, we collect:

  • Account information: name, email address, company name, password (hashed)
  • Billing information: billing address, payment method details (processed and stored by our payment provider, not by us)
  • Usage data: dashboard pages visited, features used, settings configured, support requests submitted
  • Technical data: IP address, browser type, device type, timestamps of access
  • Configuration data: the brand settings, reward rules, email templates, and widget customizations you configure

From End Users (your advocates and their referrals)

When End Users interact with your Advocate Loop-powered widget or emails, we collect on your behalf:

  • Identity data: first name, last name, email address (collected via your widget when they sign up as advocates)
  • Referral activity: referral codes generated, referral links shared, conversions attributed
  • Reward activity: discount codes earned, redemption status, reward amounts
  • Technical data: IP address, browser type, timestamps of interactions with the widget

We do not collect: medical records, health information, social security numbers, government IDs, financial account numbers (other than what’s needed to process Customer payments), biometric data, location data beyond IP-based country, or content of email messages your End Users send to each other.

3. How we use information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Process transactions and send transactional emails (e.g. account confirmations, password resets, invoices)
  • Send service-related communications, updates, and security notices
  • Send promotional emails about our Service (you can opt out anytime)
  • Detect, investigate, and prevent fraudulent or unauthorized activity
  • Comply with legal obligations
  • Provide aggregate, de-identified analytics about Service usage to help us improve the product

We do not use Customer data or End User data to train AI or machine learning models.

4. Legal bases for processing (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

  • Contract: processing necessary to provide the Service you’ve signed up for (e.g. account creation, billing, sending you the features you’ve configured)
  • Legitimate interest: processing necessary to operate and improve our business, where our interests don’t override your rights — for example, security monitoring, fraud prevention, and aggregate product analytics for authenticated users
  • Consent: for non-essential cookies and analytics on our marketing site, and for marketing communications. You can withdraw consent at any time.
  • Legal obligation: when we’re required to retain or process information by law (e.g. tax records)

5. How we share information

We share information only as follows:

With service providers

We use third-party service providers (“subprocessors”) to help us operate the Service. These providers are contractually bound to use information only as needed to provide their services to us:

  • Authentication: Clerk (account login and identity)
  • Hosting and infrastructure: Vercel and Railway (application hosting and edge delivery)
  • Database: Railway PostgreSQL (data storage)
  • Payments: Paddle (subscription processing and merchant of record)
  • Email delivery: Resend (transactional email)
  • Product analytics: Mixpanel (US-based; processes anonymous and authenticated user activity to help us understand how the Service is used)

A current list of subprocessors with links to their privacy policies is available on request. We’ll notify Customers of material changes to subprocessors before they take effect.

Between Customers and End Users

End User data collected through your Advocate Loop widget belongs to you (the Customer). We process it on your behalf as a data processor. We share End User identity and referral activity with you, the Customer who controls the program. We do not share one Customer’s data with any other Customer.

For legal reasons

We may disclose information if required by law, court order, subpoena, or to:

  • Comply with a legal obligation
  • Protect the rights, property, or safety of Advocate Loop, our Customers, or others
  • Investigate or prevent fraud or security issues

We will notify Customers of legal requests for their data unless prohibited by law.

Business transfers

If Advocate Loop is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We do not sell your personal information. We do not rent or trade End User contact information for marketing purposes.

6. Cookies and tracking technologies

We use a small number of cookies and similar technologies (such as localStorage) to provide and improve the Service. The categories we use:

Strictly necessary

These are required for the Service to function and do not require consent. Examples:

  • Authentication session tokens (set by Clerk when you sign in to your account)
  • Your cookie consent preference (so we don’t ask you again on every visit)
  • CSRF protection tokens

Analytics (consent required on the marketing site)

We use Mixpanel to understand how our Service is used. On our marketing site (advocateloop.com), Mixpanel only runs after you affirmatively accept analytics through our cookie banner. Inside the authenticated dashboard (app.advocateloop.com), analytics run as part of providing the Service, as a legitimate interest, and you can opt out at any time by contacting privacy@advocateloop.com.

Analytics data collected includes: pages visited, features clicked, approximate location (country/region), browser type, device type, and how you arrived at our site (referrer, UTM parameters). We do not collect content of communications or sensitive personal data through analytics.

Managing your preferences

You can change your analytics cookie preference at any time using the “Cookie Settings” link in our footer. If you decline, your previous decision is honored for 6 months; after that, we’ll ask again. If you accept, your preference is honored until you change it.

7. Data retention

We retain Customer account information for as long as your account is active. You can delete your account at any time from your account settings; once deleted, we permanently remove your data within 30 days, except where retention is required by law (e.g. financial records for tax purposes).

End User data is retained as long as your account is active. If you cancel your account, End User data is deleted on the same schedule as your account data, unless you separately request export or earlier deletion.

Analytics data from our marketing site is retained for up to 24 months unless you withdraw consent, at which point the associated profile is deleted upon request.

Backup copies are retained for up to 60 days after deletion to support disaster recovery, after which they are permanently destroyed.

8. How we protect your data

We use industry-standard security measures to protect your information, including encryption in transit (TLS 1.2+) and at rest (AES-256). We isolate each Customer’s data so that one Customer cannot access another’s. Access to production data is limited to a small number of authorized employees on a need-to-know basis.

No system is 100% secure. If we ever discover a breach involving personal data, we will notify affected Customers within 72 hours of discovery and provide details about what happened and what we’re doing about it.

9. Your rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you
  • Correction: request that inaccurate data be corrected
  • Deletion: request that your data be deleted (subject to legal retention requirements)
  • Portability: request your data in a machine-readable format
  • Objection: object to certain types of processing (e.g. marketing)
  • Restriction: request that we limit how we process your data
  • Withdrawal of consent: withdraw consent for processing based on consent at any time
  • Complaint: file a complaint with a data protection authority

For Customers, most of these rights can be exercised directly through your account settings or by emailing privacy@advocateloop.com.

For End Users: requests should generally go to the Customer (the business running the referral program), since they are the data controller. We will assist Customers in fulfilling End User requests.

10. International transfers

Advocate Loop is operated from the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) for transfers from the European Economic Area, United Kingdom, and Switzerland, and we participate in the EU-US Data Privacy Framework where applicable to our subprocessors.

11. Children

The Service is not intended for use by individuals under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers by email and update the “Last updated” date at the top of this page. Continued use of the Service after a change constitutes acceptance of the updated policy.

13. Contact us

For privacy questions, requests, or to exercise any of your rights:

For Customers in the European Economic Area, the United Kingdom, or Switzerland, you may also contact your local data protection authority.