Privacy Policy

How LooneyTech Ltd collects, uses and protects personal data.

Last updated: 27 August 2026

Draft: needs legal review

This document is a working draft prepared to reflect how LooneyTech operates. It has not been reviewed by a solicitor and should not be relied on as legal advice. Have it checked before launch.

Who we are

LooneyTech Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for personal data collected through this website and for data processed in delivering our services. Contact us at advice@looneytech.co.uk.

What we collect

Website enquiries. Name, work email, company name and the content of your message, submitted through our contact form.

Workspace Audit customers. When you authorise a Workspace Audit, we read configuration and audit-log data from your Google Workspace tenant. This includes user account status, MFA enrolment, sharing settings, connected third-party applications, group membership, device compliance state and admin activity logs. It may include the names and email addresses of your users, and the titles of files and calendars whose sharing settings are flagged.

We do not read content. The audit does not access the body of emails, the contents of documents, or files stored in Drive.

Billing. Payments are processed by Stripe. We receive confirmation of payment and your billing email, but we never see or store your card details.

Why we process it, and our lawful basis

To respond to enquiries and provide the services you have asked for: performance of a contract, or legitimate interests where no contract is yet in place.

To produce your audit report and compare against previous scans: performance of a contract.

To meet our own legal and accounting obligations: legal obligation.

How long we keep it

Enquiry data is kept for 24 months from last contact.

Audit results are retained for the duration of your relationship with us so scans can be compared over time, and deleted within 30 days of a written request or of your account closing.

Financial records are kept for six years as required by UK tax law.

Who we share it with

We do not sell personal data. We share it only with providers who help us deliver the service: Google (Workspace and Apps Script infrastructure), Stripe (payments) and Cloudflare (website hosting).

Each is bound by its own data processing terms. We do not transfer personal data outside the UK or EEA except under an approved safeguard such as the UK International Data Transfer Agreement.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and the right to data portability. To exercise any of these, email advice@looneytech.co.uk.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Audit access is read-only and scoped to the minimum permissions required. It cannot alter your Workspace settings, and you can revoke it at any time from your Google account. Results are stored in access-controlled systems, and access is limited to staff who need it to deliver your service.