GDPR Loops
In an indie stack, Loops is used for Transactional and marketing emails. Entity cited: Astrodon Corporation (Loops). The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Loops
Yes. Public Data Processing Agreement.
Stated role
The DPA (stated update: 6 February 2025) makes the customer the controller and Astrodon Corporation the processor, for sending emails and for related troubleshooting and support. The same text states that Astrodon is an independent controller of account, billing, and support data. The policy confirms this: processor at the users' request, and controller when the processing is not done on their behalf.
Personal data
The DPA cites names, email addresses, contact details, and the other data provided by the customer to send or manage emails. Persons: employees, customers, or other users whose data the customer uploads. The policy also cites, for the account, the email, the first name, and the company or domain.
Sub-processors of Loops
Public list. It names Amazon Web Services (hosting), Amplitude, Atlas, ClickHouse, Cloudflare, Datadog, Google, People Data Labs, OpenAI, Stripe, and Slack, all indicated in the United States. The detail of each row's purposes is on the page.
Transfers outside the EU
Hosting / location
The policy states that Astrodon is established in the United States and that data, including personal data, is transferred and processed there. The sub-processor list states that each of them processes in the United States, for the duration of the contract. The DPA provides for transfers in the EEA or internationally with safeguards (standard contractual clauses, an adequacy decision, or another mechanism).
EU–United States Data Privacy Framework
The policy asserts that Astrodon is certified under the EU-U.S. Data Privacy Framework, the United Kingdom extension, and the Swiss-U.S. DPF. The exact status read on the official list on 5 October 2026: not disclosed.
Cookies
The policy indicates cookies and similar technologies for service activity, personalization, and advertising, without publishing the names. Names: not disclosed.
Typical use, written by StackLégal and not by the vendor: Transactional and marketing emails.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Loops a processor within the meaning of the GDPR?
The DPA (stated update: 6 February 2025) makes the customer the controller and Astrodon Corporation the processor, for sending emails and for related troubleshooting and support. The same text states that Astrodon is an independent controller of account, billing, and support data. The policy confirms this: processor at the users' request, and controller when the processing is not done on their behalf.
What DPA does Loops publish?
Yes. Public Data Processing Agreement. https://loops.so/dpa
Which further sub-processors does Loops publish?
Public list. It names Amazon Web Services (hosting), Amplitude, Atlas, ClickHouse, Cloudflare, Datadog, Google, People Data Labs, OpenAI, Stripe, and Slack, all indicated in the United States. The detail of each row's purposes is on the page. https://loops.so/subprocessors
Where does Loops state that it processes data, including outside the EU?
The policy states that Astrodon is established in the United States and that data, including personal data, is transferred and processed there. The sub-processor list states that each of them processes in the United States, for the duration of the contract. The DPA provides for transfers in the EEA or internationally with safeguards (standard contractual clauses, an adequacy decision, or another mechanism).
Is Loops registered under the EU–United States Data Privacy Framework?
The policy asserts that Astrodon is certified under the EU-U.S. Data Privacy Framework, the United Kingdom extension, and the Swiss-U.S. DPF. The exact status read on the official list on 5 October 2026: not disclosed.
Which personal data does Loops mention?
The DPA cites names, email addresses, contact details, and the other data provided by the customer to send or manage emails. Persons: employees, customers, or other users whose data the customer uploads. The policy also cites, for the account, the email, the first name, and the company or domain.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.