Privacy

Last updated 5 November 2026 · Service operated from Israel

Lawyer review pending. This text is written to describe the product accurately, but it has not yet been reviewed by a lawyer.

What LadyBugLoop is

LadyBugLoop is a bug-reporting tool. A tester taps one button in an app that has installed our SDK, describes a problem out loud, and we turn that into a report for the team that develops the app.

Who operates LadyBugLoop

LadyBugLoop is operated by Ifat Biran, an Israeli sole proprietor (עוסק פטור, a VAT-exempt dealer). Contact for privacy questions: support@ladybugloop.com.

Who is responsible for the data

The company that installs LadyBugLoop in its app (our customer) decides who tests the app and what may be captured. The customer is responsible for that data and for telling its testers. LadyBugLoop processes reports on the customer's behalf, only to provide the service.

Roles under data protection law

Legal bases for our own processing

For data we control, we rely on contract (to provide the account and the service ordered, and to bill for it) and legitimate interest (to secure the service, prevent abuse and fraud, and keep it working). For tester data, the customer decides the legal basis for capture, and we process it only on the customer's instructions.

What is captured when a tester files a report

Report content leaves the device only when the tester sends a report. Until then it is held in the browser's memory and is dropped when the page closes. The one exception: a report whose send failed is kept on the device, with its voice note and screenshot, and retried. It is kept for up to 7 days, at most 20 reports, and is dropped after 10 failed attempts. Retry re-sends only a report the tester already chose to send. A report too large to send is not kept, and nothing is kept where the browser blocks on-device storage.

Three small messages are sent without a report: a check when the page loads that this person may report on the project, a record of the tester's consent choice, and a new attempt to send a report that was sent before but did not arrive. Such a report waits on the device for up to 7 days.

On the tester's own device only: the title and the start of each report they sent, the follow-up question and the answer, kept in the browser's local storage for the "My reports and conversations" screen, separately for each app. It is erased after 30 days, or at once when the tester declines consent. This copy is never sent anywhere.

What is hidden before anything is sent

Masking runs in the browser, before the report leaves the device.

Masking finds known patterns. It does not recognise every personal detail, for example a name written in plain text. An app that shows sensitive data should mark those areas.

Voice and transcription

Voice notes are turned into text by Google Gemini, or by OpenAI Whisper when Gemini is not available. The recording and the text are both kept with the report. The voice is used only for its words: we do not create a voiceprint and we do not identify anyone by voice.

AI providers and model training

We use the paid business APIs of OpenAI and Anthropic. Under their current terms, these providers do not use the data we send to train their models. They may keep it for a limited time to detect abuse (up to 30 days).

Google's no-training terms apply to its paid tier. We are moving our Google account to the paid tier; until that is confirmed, Google's free-tier terms apply and may allow it to use the data to improve its products.

ElevenLabs receives only the text of a follow-up question, never the recording. Automatic fixes run in the customer's own GitHub repository with the customer's own Anthropic account, so the terms of that account apply to them.

Who can see a report

Only the owners of the project the report was filed against. Reports are stored in a private bucket and access is enforced per project, so one customer cannot read another customer's reports. We do not sell reports and we do not use them for advertising.

Who else processes a report

Reports are stored in Supabase, in its Frankfurt region (eu-central-1). These providers may each receive part of a report, and only for the purpose named:

We do not add a provider to this list without updating this page.

Data outside Israel

Some of these providers process data outside Israel, including in the United States and, for Resend, Japan. The next section lists the basis for the providers we have checked. For Telegram, Resend, PayPlus and Morning we have not yet verified and listed a transfer basis.

International transfers

We operate from Israel, so personal data may be accessed and handled in Israel. The European Commission recognises Israel as providing an adequate level of data protection (Decision 2011/61/EU), so EU data can be transferred there without additional safeguards.

Reports are stored in Frankfurt. Some providers process data in the United States. The basis for those transfers:

How long we keep it

A project owner can set how many days reports are kept. Older reports, with their recording, replay and screenshot, are meant to be deleted automatically; the scheduled deletion is still being rolled out, so until it is confirmed live, ask us and we delete them. When no period is set, a report is kept until the project owner deletes it or asks us to.

When a tester withdraws consent, that tester's reports are hidden at once and we delete them on request, with automatic deletion still being rolled out. The record of the consent choice itself is kept, as proof that capture was allowed.

Your requests

Write to support@ladybugloop.com to ask what is held about you, to get a copy, to correct it, or to have it deleted. We answer within 30 days. When a request is about a customer's app, we handle it together with that customer.

Your rights

Where the GDPR applies, you have the right of access, rectification, erasure, restriction of processing, data portability, and objection. A tester should first contact the customer whose app the report was filed in. Requests can also be sent to support@ladybugloop.com.

You may lodge a complaint with a supervisory authority, in the EU member state where you live, work or where the alleged infringement took place. Where the UK GDPR applies, the same rights apply and the supervisory authority is the Information Commissioner's Office (ICO).

Where the service runs

LadyBugLoop is operated from Israel and is offered to customers worldwide. Data is processed by the providers listed above, some of them outside Israel.

Back to LadyBugLoop · Terms · Accessibility · Licenses