Privacy Policy

Introduction

At truloop, privacy isn't an afterthought, it's part of our design. This Privacy Policy explains how But Beautiful Co. collects, uses, shares, and protects your personal information when you use truloop and related services.

By using truloop, you agree to the practices described here. If you have questions, reach out to us at support@butbeautifulco.com.

1. Information We Collect

We collect information you give us, event-related information (RSVPs, tickets, Host custom questions), basic technical information (device, IP, cookies), and — only with your permission — your address book contacts. Payment card data is collected and stored by Stripe, not us.

A. Information You Provide

• Name, email address, phone number, and profile photo (if provided).
• Content you create within truloop.
• Support requests and feedback.
• Survey or form responses.

B. Event and Ticket Information

We may collect information you provide when you create or join events, purchase tickets, RSVP, communicate with Hosts or other users, or answer event-specific questions requested by a Host, such as attendee names, contact information, ticket details, preferences, age eligibility, or other information needed to administer the event.

C. Address Book (Contacts) — Optional

With your permission, we may access your device contacts to help you find or invite people you know. Contact access is optional, and you may revoke it through your device settings. We do not use address book contacts to send marketing messages to non-users without appropriate consent.

D. Information Collected Automatically

• Device and browser type, push token, and messaging-platform identifiers (where you have authorized push or messaging notifications).
• IP address, general location inferred from IP, usage data, and error logs.
• Cookies and similar tracking technologies.

2. How We Use Your Information

To operate the service, support you, prevent fraud, send service-related messages, and — only with your opt-in — send marketing communications.

We use collected data to operate and improve the service, personalize your experience, respond to support inquiries, and maintain service integrity and security.

We may occasionally send service-related updates (e.g., policy changes or billing notices). You can control promotional email preferences in your account settings.

Service Messages

By using truloop and providing your phone number, you receive service messages that are part of how the service works. These include authentication and security alerts, loop invitations from other users, activity updates within loops you have joined, event reminders, ticket confirmations, and account or policy notifications. Service messages may be delivered by SMS, push notification, or third-party messaging platforms (including KakaoTalk). They are not promotional and cannot be turned off while you use the service.

Marketing Communications

Marketing messages are messages whose primary purpose is to promote truloop products, features, offers, or events that you did not register for. With your separate opt-in consent, we may use your phone number, push token, or messaging platform identifier to send marketing messages through SMS, push notifications, or third-party messaging platforms such as KakaoTalk. You may withdraw your consent at any time through Settings > Notifications, by replying STOP, or through other opt-out methods we provide.

3. Information Shared with Third Parties

We share data with service providers (AWS, analytics, Stripe), with Hosts when you join their events, and as required by law. Stripe handles all payment card information directly under PCI DSS. Hosts may use Guest information only for event-related purposes.

A. Service Providers and Business Partners

Cloud hosts (Amazon Web Services), fraud detection services, customer support platforms, and financial or operational partners may receive data solely for service delivery purposes. See Section 5 for more about where our infrastructure is located.

B. At Your Request

Information is shared when you interact with other truloop users via shared features or engage with third-party promotions with your consent.

C. Analytics Services

We use Google Analytics and similar tools to understand user interaction patterns and improve the service.

D. De-identified or Aggregated Data

Used for product improvement and market insights without individual identification.

E. Subsidiaries and Affiliates

Data may be shared internally for administration, compliance, or operations.

F. Business Transactions

Data may transfer to acquiring entities if truloop or its assets are acquired.

G. Legal and Compliance Disclosures

Information may be disclosed if required by law or to protect rights, property, safety, or prevent illegal activity.

H. Payment Processing — Stripe

Payments on truloop are processed by Stripe, Inc. ("Stripe"). When you make any payment, your payment card data is collected directly by Stripe under PCI DSS Self-Assessment Questionnaire A (SAQ A) scope. truloop does not receive, transmit, or store full payment card information. Stripe's privacy practices are described at stripe.com/privacy.

I. Stripe Connect — Hosts and Ticket Sales

For ticket sales by Hosts, truloop operates as a "Stripe Connect Platform" and Hosts use Stripe Connect Standard accounts.

If you are a Host, Stripe (not truloop) collects and verifies your identity, tax identification number (such as SSN, ITIN, or EIN), and bank account information. Stripe may issue you IRS Form 1099-K directly if your transactions meet reporting thresholds (currently more than $20,000 in gross payments AND more than 200 transactions per calendar year, per IRS guidance). Some states require lower thresholds.

If you are a Guest, your name, email, ticket details, and any custom information required by the Host are shared with the Host so they can deliver the event.

J. Hosts' Use of Guest Information

Hosts may use Guest information only to operate and administer the relevant event, communicate with Guests about that event, process refunds or support requests, and comply with applicable law. Hosts may not use Guest information for unrelated marketing, resale, profiling, or disclosure to third parties without the Guest's consent. These restrictions are also set out as binding Host obligations in our separate Host Agreement.

4. Your Choices

You can unsubscribe from marketing, manage cookies, request access/correction/deletion of your data, and revoke address book access.

A. Emails and Promotions

You can unsubscribe from marketing emails using the links provided in each message. Service-related communications cannot be disabled.

B. Cookies and Tracking Preferences

You can manage cookies through your browser settings or our interface. We do not currently respond to Do Not Track signals.

C. Address Book Access

You may revoke truloop's access to your device contacts at any time through your device settings.

D. Access, Edit, or Delete Your Information

Email support@butbeautifulco.com to request access, correction, or deletion of your data. We will honor your request unless legally required retention applies.

E. Non-Affiliate Marketing

Your personal data is not shared with third-party marketers without your explicit opt-in.

5. International Transfers and Data Processing Locations

We operate truloop from the United States, but our primary application servers are hosted on Amazon Web Services (AWS) in the Republic of Korea. Cached content (such as images and static assets) may be stored in AWS edge locations around the world to improve performance. For users in the EU, UK, or Switzerland, transfers to Korea are covered by the European Commission's adequacy decision for the Republic of Korea.

We operate truloop from the United States. Our primary application servers are hosted on Amazon Web Services (AWS) in the Republic of Korea. Cached content — such as images, static assets, and certain technical files used to deliver the service — may be stored in AWS edge locations around the world to improve performance and availability.

If you access truloop, your personal information may be transferred to and processed in countries other than your country of residence, including the Republic of Korea, the United States, and other AWS regions where cached content is delivered from.

For residents of the European Economic Area, the United Kingdom, and Switzerland, the European Commission has issued an adequacy decision recognizing the Republic of Korea as providing an adequate level of data protection (effective December 17, 2021). Personal data may therefore be transferred from these regions to the Republic of Korea without requiring additional transfer safeguards. Where data flows to other countries that have not received an adequacy decision, we rely on Standard Contractual Clauses or similar safeguards. GDPR protections apply for EEA, UK, and Swiss residents.

By using truloop, you consent to these international transfers.

6. Your Rights

You may have rights under CCPA, GDPR, and similar laws — access, correction, deletion, and others. Email us to exercise them. California residents see Section 11 for specific notice.

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict processing of, or withdraw consent for your personal data. We will notify you if your request cannot be fulfilled due to legal obligations.

California residents have additional rights described in Section 11 (Notice to California Residents).

7. Data Retention

We retain data by category — account information for the life of your account plus a reasonable period; event and ticket metadata as needed to operate the service and resolve disputes; support and consent records as needed for compliance. Payment transaction records are kept by Stripe (typically 7 years).

We retain account information for as long as your account remains active and for a reasonable period thereafter as needed for legal compliance, fraud prevention, dispute resolution, and backup purposes. Event and ticket transaction metadata may be retained as needed to operate the service, support Hosts and Guests, comply with legal obligations, and resolve disputes. Support records and consent records may be retained for the period reasonably necessary to document our compliance and respond to requests.

Payment transaction records are retained by Stripe (not truloop) for the period required by financial regulations (typically seven years). truloop retains only transaction metadata (such as ticket ID, host ID, event ID) required for service operation.

8. Security

We use encryption, access controls, and secure infrastructure. No system is 100% secure. We will notify you of a breach as required by applicable law.

We use encryption (including SSL), access controls, and secure infrastructure to protect your data. However, no method of storage or transmission is 100% secure.

In the event of a data breach involving your personal information, we will provide notice as required by applicable law, which may include email, in-app notice, or other legally permitted methods.

9. Children's Privacy

truloop is not designed for children under 13 (COPPA). We delete any such information promptly upon discovery.

truloop is not designed for children under 13. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect their data and will delete any such information promptly upon discovery.

10. Changes to This Policy

We will notify you of material changes via app or email before they take effect.

We may update this policy periodically. Material changes will be communicated via app alerts or email before they take effect.

11. Notice to California Residents (CCPA / CPRA)

California residents have rights under the CCPA and CPRA to know, delete, correct, and not be discriminated against. truloop does not sell personal information and does not share personal information for cross-context behavioral advertising. To exercise rights, email support@butbeautifulco.com.

This section provides additional information for California residents under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) and the California Privacy Rights Act (CPRA).

11.1 Categories of Personal Information We Collect

In the preceding twelve (12) months, we have collected the following categories of personal information from California residents:

11.1.1 Sensitive Personal Information

truloop does not intentionally collect sensitive personal information unless you choose to provide it or it is necessary for a specific event feature, legal compliance, age eligibility, safety, or accessibility-related request.

Hosts may not request sensitive personal information through event forms unless expressly permitted by truloop and required for lawful event administration.

11.2 Purposes for Collecting Personal Information

We collect personal information to operate and improve the service, communicate with you about your account, prevent fraud, comply with legal obligations, and where you have opted in, send marketing communications.

11.3 Sources of Personal Information

• Directly from you (when you sign up, post content, or contact support).
• Automatically from your device (cookies, IP address, usage).
• From third parties at your direction (e.g., Stripe for payment confirmation, social media if you choose to connect, your address book if you grant access).

11.4 Disclosures of Personal Information

We disclose categories of personal information to: cloud service providers (e.g., AWS), analytics providers (e.g., Google Analytics), payment processors (Stripe), Hosts of events you attend, and law enforcement when legally required, as described in Section 3.

11.5 Sale or Sharing of Personal Information

We do not sell personal information for monetary or other valuable consideration.

We do not share personal information for cross-context behavioral advertising as defined by Cal. Civ. Code § 1798.140(ah). truloop does not use advertising or social media partners to place ad cookies or similar technologies for cross-context behavioral advertising on our service. If our practices change in the future, we will update this Policy in advance and provide the required notices and opt-out mechanisms.

11.6 California Privacy Rights

As a California resident, you have the right to:

• Know what personal information we collect, use, and disclose about you.
• Request a copy of your personal information.
• Delete your personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit use of sensitive personal information.
• Non-discrimination for exercising your rights.

11.7 How to Exercise Your Rights

Email support@butbeautifulco.comwith the subject "California Privacy Request" and indicate which right you are exercising. We will respond within 45 days as required by law. We may need to verify your identity by requesting information from your account.

11.8 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization, and we may require you to verify your identity directly.

11.9 Retention

We retain personal information for the period necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements, as further described in Section 7.

12. Contact

But Beautiful Co.

support@butbeautifulco.com