What Soloop does
Soloop is an AI cofounder that plans, builds & markets your company. It uses the ideas, links, code, files, and instructions you provide to run tasks and keep their results in your workspace.
Chats, documents, tasks, feedback, and execution records give Soloop context for your company and its previous work.
The product is still in beta. Features, integrations, pricing, data flows, and retention rules can change as we tighten the product.
Data we collect
We collect the records that make the workspace work: what you type, what you upload, what Soloop creates, what connected services return, and server records for login, security, and debugging.
Do not upload secrets, private keys, production credentials, regulated data, private customer records, health data, financial account data, or sensitive personal data unless you have the right to use it here and have decided Soloop is the right place for it.
Analytics records can include an anonymous visitor and session ID, public-page paths, active time, explicitly labelled clicks, source attribution, referrer host, consent history, and the account link created after successful authentication.
Email, name, authentication provider, login metadata, billing plan, credit balance, and account timestamps.
Project name, product description, URLs, repo URL, onboarding doc draft, generated app records, and project status.
Uploaded decks, PDFs, ZIPs, source files, filenames, file size, MIME type, hashes, extracted text, storage paths, and vector-search IDs.
Messages, conversation titles, tasks, confirmations, edits, task status, results, acceptance criteria, logs, sandbox IDs, and deployment URLs.
Provider name, external username, external email, scopes, status, token expiry, encrypted refresh-token fields, OAuth state, GitHub installation metadata, and Stripe account metadata.
Twitter/X or other approved-source URLs, comments, author handles, public feedback, LLM analysis, qualified-user records, and notifications.
How Soloop uses data
Soloop uses company context for the task it is running. That context can include recent messages, documents, task instructions, files, account status, feedback, and prior results.
Tasks that publish, deploy, spend credits, use connected accounts, or change code use the permissions and product controls for that action.
Plan your tasks
Soloop uses your company documents, recent messages, task status, feedback, and account connection status to plan the work.
The context used depends on the task and the information available in your workspace.
Research your market
Soloop uses your research question and company context to search public sources and save findings in Tasks.
It uses private connected accounts only when the feature clearly asks for that access.
Publish on X
Soloop uses your connected X account for drafts, posts, replies, media uploads, account-limit checks, and response monitoring.
No post or reply goes out without a connected account and the visible product flow.
Reach communities
Soloop uses public community information, your company context, and the Reddit connection available for the task to prepare posts or replies.
Publishing depends on the account connection, community rules, and product controls shown for the task.
Send outreach
Soloop uses recipient details, message content, and your connected email account to prepare and send outreach or replies.
Sending requires an eligible connected account and the permissions needed for the task.
Run campaigns
Soloop uses your product link, campaign content, targeting, account information, and budget to prepare and run campaigns.
Launching and spending depend on the campaign settings and required payment steps shown in the product.
Build your product
Soloop uses the task brief, project files, code, sandbox logs, test output, and deployment status to build or change your product.
Review code, logs, deployment changes, and data manifests before shipping them to users.
AI training
Soloop does not use workspace content, uploaded files, connected-account content, generated code, or signals to train a general Soloop model.
When a task uses an AI model, we send the prompt plus relevant context to model or routing providers such as OpenAI-compatible providers, TokenRouter, Anthropic, or other providers used by the product.
Those providers return output and keep the abuse, safety, debug, or billing records their own policies, contracts, and retention settings allow.
AI output can be wrong, incomplete, outdated, duplicated, insecure, or unsuitable for your use. You are responsible for reviewing output before publishing, deploying, sending, or relying on it.
OAuth and connected accounts
If you connect Twitter/X, Reddit, GitHub, Stripe, or another service, we store account metadata to show status and run the feature you chose.
Where refresh tokens are needed, Soloop stores them encrypted with AES-256-GCM fields. OAuth state records finish authorization flows and resume the pending task.
GitHub App installation records store installation metadata. Short-lived GitHub installation access tokens are generated on demand and are not persisted.
Stripe Connect account links are temporary and created on demand. Soloop stores connected-account metadata such as Stripe account ID, country, currency, charges status, payouts status, requirements, and email when Stripe returns it.
Stripe processes subscription billing, taxes, invoices, payment methods, and customer records on its hosted payment surfaces. We do not receive or store full card numbers or CVC.
You can revoke a connected account in the external service. You can also ask us to disconnect or delete the related Soloop records.
Cookies and logs
Soloop uses cookies and similar browser storage for login, session refresh, security, product state, traffic-source attribution, Google Analytics 4 usage measurement, and Google Ads conversion measurement.
Servers and providers collect IP address, user agent, request path, timestamps, errors, performance data, and diagnostics to keep the service working, detect abuse, and debug failures.
Google Analytics and Google Ads may receive pseudonymous identifiers, page and session information, traffic-source data, browser or device information, approximate location, and confirmed-registration conversion events. The Cookie Policy describes current cookie names, purposes, durations, and browser choices.
Security
Soloop uses account ownership checks, server-side authorization, encrypted refresh-token storage, scoped OAuth flows, short-lived authorization state, sandboxed coding execution, provider access controls, and operational logs.
No internet service is perfectly secure. Do not put production secrets, private keys, customer databases, or regulated data into Soloop unless you have decided the risk is acceptable.
If you believe your account, token, repo access, Stripe account, or workspace has been exposed, contact us quickly and revoke the affected external connection where possible.
Retention and deletion
We keep account records while your account exists. We keep project records while the project is active, unless product behavior or law calls for a shorter period.
Project deletion can remove or queue cleanup for project documents, storage objects, conversations, messages, direct channel tasks, coding tasks, signals, notifications, and OpenAI vector-store references tied to that project.
Some records can remain longer for security, fraud prevention, billing, accounting, legal obligations, disputes, abuse review, backups, debugging, or product operation.
Raw public-page analytics events and source page views are kept for up to 90 days. Analytics consent records and the separate waitlist funnel can be kept for up to 13 months. Aggregated, de-identified reporting may be kept longer when it can no longer reasonably identify a person or browser.
Backups and provider records do not always disappear instantly. Deletion can take time to finish across every system.
When we no longer need retained personal data, we delete it or anonymize it so it can no longer reasonably identify you, subject to legal and operational limits.
Your choices and rights
You can choose what to upload, what to connect, what to approve, and what to publish or deploy.
Your location can give you rights to access, correct, export, delete, restrict, or object to some processing of your personal data.
You can revoke external account access through the external service. Related Soloop tasks can stop working until you reconnect.
You can ask us for account deletion, project deletion, data export, correction, or privacy review through the contact channel below.
The current site enables analytics and conversion measurement by default for new visitors. First-party analytics respects a previously saved browser choice. There is currently no separate in-site analytics toggle. You can limit measurement through browser controls and Google's opt-out tools, or contact us about your data.
Children
Soloop is not for children. You must be at least 18 years old, or the age of majority where you live, to use the product.
If you believe a child provided personal data to Soloop, contact us so we can review and delete it where required.
Changes
We update this Privacy Policy when the product, integrations, laws, or data flows change.
If a change materially affects you, we will give notice by posting the updated policy or using an in-product notice.
Contact
For privacy, security, deletion, export, or account-access requests, use the email link below.
Soloop, Inc. is responsible for this policy. Postal address: 6357 Joaquin Murieta Ave, Newark, CA 94560, United States. Email: [email protected].
[email protected]